Ghostscript - World's favourite open-source PDF interpreter needs patching (again)

guest · Jan 24, 2019

World's favourite open-source PDF interpreter needs patching (again)
January 24, 2019
https://www.theregister.co.uk/2019/01/24/pdf_ghostscript_vulnerability/

Google Project Zero bug-hunter Tavis Ormandy took a "random look at the new release" of Ghostscript, and turned up a vulnerability that works in all versions up to 9.26.
Ormandy made his latest discovery on 11 December, and with patches available, today went public with the bug.

While the bugs are tricky to exploit, Ormandy offered a proof of concept that "gives me a high degree of control over the routine" that works with "Evince, ImageMagick, Nautilus" as well as the Gimp editor and other libraries.

However, he's still wary of the whole thing, writing that "untrusted postscript needs to be deprecated ASAP", something that echoed his August 2018 call for GhostScript to be dumped.
Click to expand...

Log in or Sign up

Ghostscript - World's favourite open-source PDF interpreter needs patching (again)

guest Guest

Log in or Sign up

Ghostscript - World's favourite open-source PDF interpreter needs patching (again)

guest Guest

Useful Searches