Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5445 > unrolled thread
| Started by | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| First post | 2018-09-03 23:40 +0200 |
| Last post | 2018-09-06 21:10 +0200 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.debian.security
Testers needed for ghostscript update Moritz Mühlenhoff <jmm@inutil.org> - 2018-09-03 23:40 +0200
Re: Testers needed for ghostscript update Moritz Mühlenhoff <jmm@inutil.org> - 2018-09-05 11:50 +0200
Re: Testers needed for ghostscript update Celejar <celejar@gmail.com> - 2018-09-05 14:30 +0200
Re: Testers needed for ghostscript update Jason Fergus <leech@thefnords.org> - 2018-09-05 18:20 +0200
Re: Testers needed for ghostscript update Moritz Mühlenhoff <jmm@inutil.org> - 2018-09-06 21:10 +0200
| From | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| Date | 2018-09-03 23:40 +0200 |
| Subject | Testers needed for ghostscript update |
| Message-ID | <wu4JH-2Sk-3@gated-at.bofh.it> |
There's a number of vulnerabilities found in Ghostscript by Tavis
Ormandy. His research is still ongoing with new issues being found,
but I've created an interim update which addresses most of the recent
issues he found. It works fine in my tests, but my use case is
fairly limited (printing via a local inkjet printer), so I need some
additional external testing before this can be released. Packages
are at https://people.debian.org/~jmm/gs/, please reply directly
to me both for positive and negative test feedback.
Cheers,
Moritz
[toc] | [next] | [standalone]
| From | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| Date | 2018-09-05 11:50 +0200 |
| Message-ID | <wuCBH-5Nj-1@gated-at.bofh.it> |
| In reply to | #5445 |
Moritz Mühlenhoff <jmm@inutil.org> schrieb:
> There's a number of vulnerabilities found in Ghostscript by Tavis
> Ormandy. His research is still ongoing with new issues being found,
> but I've created an interim update which addresses most of the recent
> issues he found. It works fine in my tests, but my use case is
> fairly limited (printing via a local inkjet printer), so I need some
> additional external testing before this can be released. Packages
> are at https://people.debian.org/~jmm/gs/, please reply directly
> to me both for positive and negative test feedback.
This received zero test feedback so far. If noone is using Ghostscript
besides me, I probably don't need to release this via security.debian.org
to begin with...
Cheers,
Moritz
[toc] | [prev] | [next] | [standalone]
| From | Celejar <celejar@gmail.com> |
|---|---|
| Date | 2018-09-05 14:30 +0200 |
| Message-ID | <wuF6y-7k2-9@gated-at.bofh.it> |
| In reply to | #5446 |
On Wed, 5 Sep 2018 11:44:23 +0200 Moritz Mühlenhoff <jmm@inutil.org> wrote: > Moritz Mühlenhoff <jmm@inutil.org> schrieb: > > There's a number of vulnerabilities found in Ghostscript by Tavis > > Ormandy. His research is still ongoing with new issues being found, > > but I've created an interim update which addresses most of the recent > > issues he found. It works fine in my tests, but my use case is > > fairly limited (printing via a local inkjet printer), so I need some > > additional external testing before this can be released. Packages > > are at https://people.debian.org/~jmm/gs/, please reply directly > > to me both for positive and negative test feedback. > > This received zero test feedback so far. If noone is using Ghostscript > besides me, I probably don't need to release this via security.debian.org > to begin with... Okay, I just tried it. I installed: ghostscript_9.20~dfsg-3.2+deb9u3_amd64.deb libgs9_9.20~dfsg-3.2+deb9u3_amd64.deb libgs9-common_9.20~dfsg-3.2+deb9u3_all.deb onto a Sid system (dpkg warned that it was downgrading all three from 9.22~dfsg-3), and printed a test page from the CUPS admin web interface. The page looks good, although the printer printed three copies - not sure if that's something I asked for by mistake, some misconfiguration on my part (although I've printed many test pages before without this problem), or an actual problem with gs. This is a Brother HL2280DW, printing via local network, using Brother's proprietary drivers. Celejar
[toc] | [prev] | [next] | [standalone]
| From | Jason Fergus <leech@thefnords.org> |
|---|---|
| Date | 2018-09-05 18:20 +0200 |
| Message-ID | <wuIH7-11u-5@gated-at.bofh.it> |
| In reply to | #5447 |
On Wed, 2018-09-05 at 08:20 -0400, Celejar wrote: > On Wed, 5 Sep 2018 11:44:23 +0200 > Moritz Mühlenhoff <jmm@inutil.org> wrote: > > > Moritz Mühlenhoff <jmm@inutil.org> schrieb: > > > There's a number of vulnerabilities found in Ghostscript by Tavis > > > Ormandy. His research is still ongoing with new issues being > > > found, > > > but I've created an interim update which addresses most of the > > > recent > > > issues he found. It works fine in my tests, but my use case is > > > fairly limited (printing via a local inkjet printer), so I need > > > some > > > additional external testing before this can be released. Packages > > > are at https://people.debian.org/~jmm/gs/, please reply directly > > > to me both for positive and negative test feedback. > > > > This received zero test feedback so far. If noone is using > > Ghostscript > > besides me, I probably don't need to release this via > > security.debian.org > > to begin with... > > Okay, I just tried it. I installed: > > ghostscript_9.20~dfsg-3.2+deb9u3_amd64.deb > libgs9_9.20~dfsg-3.2+deb9u3_amd64.deb > libgs9-common_9.20~dfsg-3.2+deb9u3_all.deb > > onto a Sid system (dpkg warned that it was downgrading all three from > 9.22~dfsg-3), and printed a test page from the CUPS admin web > interface. The page looks good, although the printer printed three > copies - not sure if that's something I asked for by mistake, some > misconfiguration on my part (although I've printed many test pages > before without this problem), or an actual problem with gs. > > This is a Brother HL2280DW, printing via local network, using > Brother's > proprietary drivers. > > Celejar > Do we have a page with a link of all the tests? I'd be more than glad to give feedback. I'm actually running stable, so don't have to downgrade anything.
[toc] | [prev] | [next] | [standalone]
| From | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| Date | 2018-09-06 21:10 +0200 |
| Message-ID | <wv7Pb-7to-3@gated-at.bofh.it> |
| In reply to | #5448 |
Jason Fergus <leech@thefnords.org> schrieb:
> On Wed, 2018-09-05 at 08:20 -0400, Celejar wrote:
>> On Wed, 5 Sep 2018 11:44:23 +0200
>> Moritz Mühlenhoff <jmm@inutil.org> wrote:
>>
>> > Moritz Mühlenhoff <jmm@inutil.org> schrieb:
>> > > There's a number of vulnerabilities found in Ghostscript by Tavis
>> > > Ormandy. His research is still ongoing with new issues being
>> > > found,
>> > > but I've created an interim update which addresses most of the
>> > > recent
>> > > issues he found. It works fine in my tests, but my use case is
>> > > fairly limited (printing via a local inkjet printer), so I need
>> > > some
>> > > additional external testing before this can be released. Packages
>> > > are at https://people.debian.org/~jmm/gs/, please reply directly
>> > > to me both for positive and negative test feedback.
>> >
>> > This received zero test feedback so far. If noone is using
>> > Ghostscript
>> > besides me, I probably don't need to release this via
>> > security.debian.org
>> > to begin with...
>>
>> Okay, I just tried it. I installed:
>>
>> ghostscript_9.20~dfsg-3.2+deb9u3_amd64.deb
>> libgs9_9.20~dfsg-3.2+deb9u3_amd64.deb
>> libgs9-common_9.20~dfsg-3.2+deb9u3_all.deb
>>
>> onto a Sid system (dpkg warned that it was downgrading all three from
>> 9.22~dfsg-3), and printed a test page from the CUPS admin web
>> interface. The page looks good, although the printer printed three
>> copies - not sure if that's something I asked for by mistake, some
>> misconfiguration on my part (although I've printed many test pages
>> before without this problem), or an actual problem with gs.
>>
>> This is a Brother HL2280DW, printing via local network, using
>> Brother's
>> proprietary drivers.
>>
>> Celejar
>>
> Do we have a page with a link of all the tests? I'd be more than glad
> to give feedback. I'm actually running stable, so don't have to
> downgrade anything.
Print something from one or two applications and send me a quick
mail whether it worked and how your print setup looks like (e.g.
actual print server and locally connected, are you using cups or
something else)
Cheers,
Moritz
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web