Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Oct 2018 08:30:43 -0500 (CDT)
From: Bob Friesenhahn <>
Subject: Re: ghostscript: 1Policy operator gives access to
 .forceput CVE-2018-18284

On Wed, 17 Oct 2018, Rich Felker wrote:
>> Even with the easy to exploit stuff compiled out (which upstream do not
>> support), I haven't been bothering to get CVE's for all the memory
>> corruption or UaF I've been reporting, because nobody can keep up with
>> these operator leaks anyway.
> An obvious fix for UaF's would be just removing the frees. Use of gs
> as an interactive program where leaks would matter is a historical
> curiosity; the only meaningful modern use is as a converter.

Memory allocations would build to extremely large values across 
hundreds of rendered pages.  Use of Ghostscript in interactive 
programs is still surely common.  Programs using libgs will inherit 
any leaks.  These leaks and other issues should be fixed.

Keep in mind that Ghostscript is also used to render/view PDF files. 
When interactively viewing it is common to do just-in-time rendering. 
Even for bulk conversions, conversion on a page-by-page basis will 
save resources when dealing with many pages.

Alternatives do exist now for PDF due to Xpdf and the derived Poppler 
project and Poppler has become heavily used.

Ghostscript is still more competent at rendering PDF than Poppler is. 
Ghostscript is able to deal with CMYK color spaces, per-object 
colorspaces, and transparency, and it is able to render to various 
quality levels (bilevel, grayscale, RGB, RGBA, CMYK) depending on the 
output driver selected.

Bob Friesenhahn,
GraphicsMagick Maintainer,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.