head	1.4;
access;
symbols
	pkgsrc-2023Q4:1.3.0.4
	pkgsrc-2023Q4-base:1.3
	pkgsrc-2023Q3:1.3.0.2
	pkgsrc-2023Q3-base:1.3
	pkgsrc-2023Q2:1.2.0.42
	pkgsrc-2023Q2-base:1.2
	pkgsrc-2023Q1:1.2.0.40
	pkgsrc-2023Q1-base:1.2
	pkgsrc-2022Q4:1.2.0.38
	pkgsrc-2022Q4-base:1.2
	pkgsrc-2022Q3:1.2.0.36
	pkgsrc-2022Q3-base:1.2
	pkgsrc-2022Q2:1.2.0.34
	pkgsrc-2022Q2-base:1.2
	pkgsrc-2022Q1:1.2.0.32
	pkgsrc-2022Q1-base:1.2
	pkgsrc-2021Q4:1.2.0.30
	pkgsrc-2021Q4-base:1.2
	pkgsrc-2021Q3:1.2.0.28
	pkgsrc-2021Q3-base:1.2
	pkgsrc-2021Q2:1.2.0.26
	pkgsrc-2021Q2-base:1.2
	pkgsrc-2021Q1:1.2.0.24
	pkgsrc-2021Q1-base:1.2
	pkgsrc-2020Q4:1.2.0.22
	pkgsrc-2020Q4-base:1.2
	pkgsrc-2020Q3:1.2.0.20
	pkgsrc-2020Q3-base:1.2
	pkgsrc-2020Q2:1.2.0.18
	pkgsrc-2020Q2-base:1.2
	pkgsrc-2020Q1:1.2.0.14
	pkgsrc-2020Q1-base:1.2
	pkgsrc-2019Q4:1.2.0.16
	pkgsrc-2019Q4-base:1.2
	pkgsrc-2019Q3:1.2.0.12
	pkgsrc-2019Q3-base:1.2
	pkgsrc-2019Q2:1.2.0.10
	pkgsrc-2019Q2-base:1.2
	pkgsrc-2019Q1:1.2.0.8
	pkgsrc-2019Q1-base:1.2
	pkgsrc-2018Q4:1.2.0.6
	pkgsrc-2018Q4-base:1.2
	pkgsrc-2018Q3:1.2.0.4
	pkgsrc-2018Q3-base:1.2
	pkgsrc-2018Q2:1.2.0.2;
locks; strict;
comment	@# @;


1.4
date	2023.12.31.20.40.32;	author gutteridge;	state dead;
branches;
next	1.3;
commitid	5xfZnjuCukbtUESE;

1.3
date	2023.07.22.10.09.06;	author adam;	state Exp;
branches;
next	1.2;
commitid	CqoJx89phJ4IDMxE;

1.2
date	2018.08.23.14.54.21;	author leot;	state Exp;
branches
	1.2.2.1;
next	1.1;
commitid	ZKXE5N6IEJNHSfPA;

1.1
date	2018.08.22.13.38.00;	author leot;	state Exp;
branches;
next	;
commitid	whUxvPB4SsAtu7PA;

1.2.2.1
date	2018.08.23.14.54.21;	author bsiegert;	state dead;
branches;
next	1.2.2.2;
commitid	zDT0jmuFbgmakxPA;

1.2.2.2
date	2018.08.25.19.26.01;	author bsiegert;	state Exp;
branches;
next	;
commitid	zDT0jmuFbgmakxPA;


desc
@@


1.4
log
@ImageMagick6: update to 6.9.13.2

No published change log found. We are also carrying an upstream patch to
fix a general image generation regression on (at least) NetBSD.
@
text
@$NetBSD: patch-config_policy.xml,v 1.3 2023/07/22 10:09:06 adam Exp $

Disable ghostscript coders by default to workaround VU#332928:
<https://www.kb.cert.org/vuls/id/332928>

--- config/policy.xml.orig	2023-07-16 11:14:27.000000000 +0000
+++ config/policy.xml
@@@@ -75,6 +75,18 @@@@
   <!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
   <!-- <policy domain="cache" name="synchronize" value="True"/> -->
   <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
+
+  <!-- 
+    -- Disable ghostscript coders as suggested by VU#332928
+    --  <https://www.kb.cert.org/vuls/id/332928>
+    -->
+  <policy domain="coder" rights="none" pattern="PS" />
+  <policy domain="coder" rights="none" pattern="PS2" />
+  <policy domain="coder" rights="none" pattern="PS3" />
+  <policy domain="coder" rights="none" pattern="EPS" />
+  <policy domain="coder" rights="none" pattern="PDF" />
+  <policy domain="coder" rights="none" pattern="XPS" />
+
   <!-- <policy domain="cache" name="synchronize" value="True"/> -->
   <!-- <policy domain="system" name="max-memory-request" value="256MiB"/> -->
   <!-- <policy domain="system" name="shred" value="1"/> -->
@


1.3
log
@ImageMagick6: updated to 6.9.12-91

6.9.12-91
Unknown changes
@
text
@d1 1
a1 1
$NetBSD: patch-config_policy.xml,v 1.2 2018/08/23 14:54:21 leot Exp $
@


1.2
log
@ImageMagick6: Also block PS2 and PS3 coders in policy.xml

At least when reading PS2 and PS3 files via
`convert PS2:<input> <output>' and `convert PS3:<input> <output>'
gslib/ghostscript will be invoked and hence subject to VU#332928.

Pointed out by Bob Friesenhahn via oss-security@@ ML (and follow up from
VU#332928 update).
@
text
@d1 1
a1 1
$NetBSD: patch-config_policy.xml,v 1.1 2018/08/22 13:39:24 leot Exp $
d6 1
a6 1
--- config/policy.xml.orig	2018-08-13 11:05:28.000000000 +0000
d8 1
a8 1
@@@@ -74,4 +74,16 @@@@
d24 3
a26 1
 </policymap>
@


1.2.2.1
log
@file patch-config_policy.xml was added on branch pkgsrc-2018Q2 on 2018-08-25 19:26:01 +0000
@
text
@d1 24
@


1.2.2.2
log
@Pullup ticket #5819 - requested by leot
graphics/ImageMagick6: security fix

Revisions pulled up:
- graphics/ImageMagick6/Makefile                                1.18-1.19
- graphics/ImageMagick6/distinfo                                1.10-1.11
- graphics/ImageMagick6/patches/patch-config_policy.xml         1.1-1.2

---
   Module Name:	pkgsrc
   Committed By:	leot
   Date:		Wed Aug 22 13:38:00 UTC 2018

   Modified Files:
   	pkgsrc/graphics/ImageMagick6: Makefile distinfo
   Added Files:
   	pkgsrc/graphics/ImageMagick6/patches: patch-config_policy.xml

   Log Message:
   ImageMagick6: Disable ghostscript coders by default in policy.xml

   Disable ghostscript coders in policy.xml as a workaround for
   VU#332928 (<https://www.kb.cert.org/vuls/id/332928>).

   Please note that apart commenting/removing lines added in policy.xml,
   the ghostscript coders can be enabled per-user by copying policy.xml
   to ~/.config/ImageMagick/policy.xml and adjusting it with the
   following lines:

     | [...]
     | <policy domain=3D"coder" rights=3D"read|write" pattern=3D"PS" />
     | <policy domain=3D"coder" rights=3D"read|write" pattern=3D"EPS" />
     | <policy domain=3D"coder" rights=3D"read|write" pattern=3D"PDF" />
     | <policy domain=3D"coder" rights=3D"read|write" pattern=3D"XPS" />
     | [...]

   Bump PKGREVISION

---
   Module Name:	pkgsrc
   Committed By:	leot
   Date:		Thu Aug 23 14:54:21 UTC 2018

   Modified Files:
   	pkgsrc/graphics/ImageMagick6: Makefile distinfo
   	pkgsrc/graphics/ImageMagick6/patches: patch-config_policy.xml

   Log Message:
   ImageMagick6: Also block PS2 and PS3 coders in policy.xml

   At least when reading PS2 and PS3 files via
   `convert PS2:<input> <output>' and `convert PS3:<input> <output>'
   gslib/ghostscript will be invoked and hence subject to VU#332928.

   Pointed out by Bob Friesenhahn via oss-security@@ ML (and follow up from
   VU#332928 update).
@
text
@a0 24
$NetBSD: patch-config_policy.xml,v 1.2 2018/08/23 14:54:21 leot Exp $

Disable ghostscript coders by default to workaround VU#332928:
<https://www.kb.cert.org/vuls/id/332928>

--- config/policy.xml.orig	2018-08-13 11:05:28.000000000 +0000
+++ config/policy.xml
@@@@ -74,4 +74,16 @@@@
   <!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
   <!-- <policy domain="cache" name="synchronize" value="True"/> -->
   <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
+
+  <!-- 
+    -- Disable ghostscript coders as suggested by VU#332928
+    --  <https://www.kb.cert.org/vuls/id/332928>
+    -->
+  <policy domain="coder" rights="none" pattern="PS" />
+  <policy domain="coder" rights="none" pattern="PS2" />
+  <policy domain="coder" rights="none" pattern="PS3" />
+  <policy domain="coder" rights="none" pattern="EPS" />
+  <policy domain="coder" rights="none" pattern="PDF" />
+  <policy domain="coder" rights="none" pattern="XPS" />
+
 </policymap>
@


1.1
log
@ImageMagick6: Disable ghostscript coders by default in policy.xml

Disable ghostscript coders in policy.xml as a workaround for
VU#332928 (<https://www.kb.cert.org/vuls/id/332928>).

Please note that apart commenting/removing lines added in policy.xml,
the ghostscript coders can be enabled per-user by copying policy.xml
to ~/.config/ImageMagick/policy.xml and adjusting it with the
following lines:

  | [...]
  | <policy domain="coder" rights="read|write" pattern="PS" />
  | <policy domain="coder" rights="read|write" pattern="EPS" />
  | <policy domain="coder" rights="read|write" pattern="PDF" />
  | <policy domain="coder" rights="read|write" pattern="XPS" />
  | [...]

Bump PKGREVISION
@
text
@d1 1
a1 1
$NetBSD$
d8 1
a8 1
@@@@ -74,4 +74,14 @@@@
d18 2
@