Wed Aug 22 13:39:24 2018 UTC ()
ImageMagick: Disable ghostscript coders by default in policy.xml

Disable ghostscript coders in policy.xml as a workaround for
VU#332928 (<https://www.kb.cert.org/vuls/id/332928>).

Please note that apart commenting/removing lines added in policy.xml,
the ghostscript coders can be enabled per-user by copying policy.xml
to ~/.config/ImageMagick/policy.xml and adjusting it with the
following lines:

  | [...]
  | <policy domain="coder" rights="read|write" pattern="PS" />
  | <policy domain="coder" rights="read|write" pattern="EPS" />
  | <policy domain="coder" rights="read|write" pattern="PDF" />
  | <policy domain="coder" rights="read|write" pattern="XPS" />
  | [...]

Bump PKGREVISION


(leot)
diff -r1.245 -r1.246 pkgsrc/graphics/ImageMagick/Makefile
diff -r1.190 -r1.191 pkgsrc/graphics/ImageMagick/distinfo
diff -r0 -r1.1 pkgsrc/graphics/ImageMagick/patches/patch-config_policy.xml
cvs diff -r1.245 -r1.246 pkgsrc/graphics/ImageMagick/Makefile (expand / switch to unified diff)

--- pkgsrc/graphics/ImageMagick/Makefile 2018/08/22 09:45:10 1.245
+++ pkgsrc/graphics/ImageMagick/Makefile 2018/08/22 13:39:24 1.246
@@ -1,16 +1,16 @@ @@ -1,16 +1,16 @@
1# $NetBSD: Makefile,v 1.245 2018/08/22 09:45:10 wiz Exp $ 1# $NetBSD: Makefile,v 1.246 2018/08/22 13:39:24 leot Exp $
2 2
3PKGREVISION= 1 3PKGREVISION= 2
4.include "Makefile.common" 4.include "Makefile.common"
5 5
6PKGNAME= ImageMagick-${DISTVERSION} 6PKGNAME= ImageMagick-${DISTVERSION}
7 7
8MAINTAINER= adam@NetBSD.org 8MAINTAINER= adam@NetBSD.org
9COMMENT= Package for display and interactive manipulation of images 9COMMENT= Package for display and interactive manipulation of images
10 10
11CONFLICTS= geomview<1.8.1nb2 # used to have a program named 'animate' 11CONFLICTS= geomview<1.8.1nb2 # used to have a program named 'animate'
12 12
13USE_LANGUAGES= c c++ c99 13USE_LANGUAGES= c c++ c99
14USE_TOOLS+= gmake pkg-config:run 14USE_TOOLS+= gmake pkg-config:run
15CONFIGURE_ARGS+= --disable-assert 15CONFIGURE_ARGS+= --disable-assert
16CONFIGURE_ARGS+= --with-fontconfig 16CONFIGURE_ARGS+= --with-fontconfig
cvs diff -r1.190 -r1.191 pkgsrc/graphics/ImageMagick/distinfo (expand / switch to unified diff)

--- pkgsrc/graphics/ImageMagick/distinfo 2018/08/16 08:23:16 1.190
+++ pkgsrc/graphics/ImageMagick/distinfo 2018/08/22 13:39:24 1.191
@@ -1,6 +1,7 @@ @@ -1,6 +1,7 @@
1$NetBSD: distinfo,v 1.190 2018/08/16 08:23:16 wiz Exp $ 1$NetBSD: distinfo,v 1.191 2018/08/22 13:39:24 leot Exp $
2 2
3SHA1 (ImageMagick-7.0.8-10.tar.xz) = c69fb5b1ec2d04711a98df8762926a37e3f13bc5 3SHA1 (ImageMagick-7.0.8-10.tar.xz) = c69fb5b1ec2d04711a98df8762926a37e3f13bc5
4RMD160 (ImageMagick-7.0.8-10.tar.xz) = 9e5339d7e4f2dbc42090cd8394bca5b97dc485ba 4RMD160 (ImageMagick-7.0.8-10.tar.xz) = 9e5339d7e4f2dbc42090cd8394bca5b97dc485ba
5SHA512 (ImageMagick-7.0.8-10.tar.xz) = a4869e0a9be5e04c04fcd1fce5c4141d63968ee7f1dd78d84724921f2f088bdcea8c3b3799e1ff555a2a04dec32a1fb7c4a1e6053a6185e9a36c6ae0f1b9c6ed 5SHA512 (ImageMagick-7.0.8-10.tar.xz) = a4869e0a9be5e04c04fcd1fce5c4141d63968ee7f1dd78d84724921f2f088bdcea8c3b3799e1ff555a2a04dec32a1fb7c4a1e6053a6185e9a36c6ae0f1b9c6ed
6Size (ImageMagick-7.0.8-10.tar.xz) = 8635496 bytes 6Size (ImageMagick-7.0.8-10.tar.xz) = 8635496 bytes
 7SHA1 (patch-config_policy.xml) = 2b7e37cc8fedb0d06502ba1d7e65a5aea9d6ec96
File Added: pkgsrc/graphics/ImageMagick/patches/patch-config_policy.xml
$NetBSD: patch-config_policy.xml,v 1.1 2018/08/22 13:39:24 leot Exp $

Disable ghostscript coders by default to workaround VU#332928:
<https://www.kb.cert.org/vuls/id/332928>

--- config/policy.xml.orig	2018-08-13 11:05:28.000000000 +0000
+++ config/policy.xml
@@ -74,4 +74,14 @@
   <!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
   <!-- <policy domain="cache" name="synchronize" value="True"/> -->
   <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
+
+  <!-- 
+    -- Disable ghostscript coders as suggested by VU#332928
+    --  <https://www.kb.cert.org/vuls/id/332928>
+    -->
+  <policy domain="coder" rights="none" pattern="PS" />
+  <policy domain="coder" rights="none" pattern="EPS" />
+  <policy domain="coder" rights="none" pattern="PDF" />
+  <policy domain="coder" rights="none" pattern="XPS" />
+
 </policymap>