Date: Wed, 5 Oct 2016 12:24:46 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: CVE Request - multiple ghostscript -dSAFER sandbox problems On Wed, 5 Oct 2016, Hanno Böck wrote: > > I was surprised to see evince in this list. It uses poppler for pdf and > libspectre for postscript, so there seems to be no use of > ghostscript (maybe in an older version). There is only one open-sourced Postscript interpreter (Ghostscript) that I am aware of. There are perhaps two open-sourced PDF interpreters available (Ghostscript and derivatives of 'xpdf' like 'poppler'). ImageMagick and GraphicsMagick are depending on Ghostscript. Since Postscript is a format commonly sent to printers, many programs produce it, and thus it is used as an intermediate format. The typical use case is for ImageMagick/GraphicsMagick to automatically run an external utility which converts from the format being read into Postscript, then Ghostscript is used to convert it to a raster format (e.g. PNM), and then the raster format is read by ImageMagick/GraphicsMagick before being output to the final format. Disabling Ghostscript or requiring user input to proceed will cause a lot of breakage. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.