Date: Tue, 9 Oct 2018 22:10:50 +0200 From: Hanno Böck <hanno@...eck.de> To: Leonid Isaev <leonid.isaev@...a.colorado.edu> Cc: oss-security@...ts.openwall.com Subject: Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Hi, On Tue, 9 Oct 2018 09:30:06 -0600 Leonid Isaev <leonid.isaev@...a.colorado.edu> wrote: > Which means any postscript file downloaded from the internet... Then > how should people read arXiv.org, for example? Surprised by this claim I did a quick check on arxiv. I don't see any papers that are only available as postscript. All papers seem to be available as PDF, some additionally as PS. Which also makes sense: Many browsers support direct PDF display. While PDF is also a complex format with pitfalls I'd still trust the in-browser PDF readers much more than something like ghostscript. If there are sites that rely on PS documents they should probably be encouraged to do a server-side sandboxed auto-conversion of them and offer PDF also. -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.