Date: Sun, 30 May 2010 22:08:12 +0200 From: "Bernhard R. Link" <brlink@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: CVE request: ghostscript and gv * Florian Weimer <fw@...eb.enyo.de> [100530 21:53]: > "gs -P- -DSAFER gs_init.ps" works, too, so you can inject the payload > with file-name-preserving user agents. 8-( > > Is the general consensus that we should patch this in > viewers/Ghostscript wrappers, and not Ghostscript itself? For Gv there is also the issue with pdf2dsc.ps (and the Debian lenny version with the temporary filei creation stuff), so it needs to be fixed anyway. Gs's -P- not working (at least for gs_init.ps), is definitly a bug that needs to be fixed. I personally would also suggest fixing gs to not look in the current directory by default (looking for important stuff in the current directory is really always a bad idea). I guess the problem is how to fix it. I think (though I am not really sure) a gs that has -P- activated by default would for example break pdf viewing of gv versions 3.6.2 to 18.104.22.168, because (I think) -P- also causes files in the current directory can no longer be opened from other postscript files with -dSAFER and the gv versions above only use -dSAFER and not -dDELAYSAFER as it would need for pdf2dsc.ps generated files. (I think -P- already has that effect, even though it has no effect on gs_init.ps). Bernhard R. Link
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.