[ubuntu/lucid-updates] ghostscript 8.71.dfsg.1-0ubuntu5.7 (Accepted)

[Ubuntu Archive Robot]

ghostscript (8.71.dfsg.1-0ubuntu5.7) lucid-security; urgency=medium

  * SECURITY UPDATE: denial of service via crafted ICC color profile
    - debian/patches/CVE-2014-8137.dpatch: prevent double-free in
      jasper/src/libjasper/base/jas_icc.c, remove assert in
      jasper/src/libjasper/jp2/jp2_dec.c.
    - CVE-2014-8137
  * SECURITY UPDATE: denial of service or code execution via invalid
    channel number
    - debian/patches/CVE-2014-8138.dpatch: validate channel number in
      jasper/src/libjasper/jp2/jp2_dec.c.
    - CVE-2014-8138
  * SECURITY UPDATE: denial of service or code execution via off-by-one
    - debian/patches/CVE-2014-8157.dpatch: fix off-by-one in
      jasper/src/libjasper/jpc/jpc_dec.c.
    - CVE-2014-8157
  * SECURITY UPDATE: denial of service or code execution via memory
    corruption
    - debian/patches/CVE-2014-8158.dpatch: remove HAVE_VLA to use more
      sensible buffer sizes in jasper/src/libjasper/jpc/jpc_qmfb.c.
    - CVE-2014-8158

Date: 2015-01-22 18:37:13.060241+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.1-0ubuntu5.7
-------------- next part --------------
Sorry, changesfile not available.