Date: Wed, 17 Oct 2018 08:30:43 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 On Wed, 17 Oct 2018, Rich Felker wrote: >> >> Even with the easy to exploit stuff compiled out (which upstream do not >> support), I haven't been bothering to get CVE's for all the memory >> corruption or UaF I've been reporting, because nobody can keep up with >> these operator leaks anyway. > > An obvious fix for UaF's would be just removing the frees. Use of gs > as an interactive program where leaks would matter is a historical > curiosity; the only meaningful modern use is as a converter. Memory allocations would build to extremely large values across hundreds of rendered pages. Use of Ghostscript in interactive programs is still surely common. Programs using libgs will inherit any leaks. These leaks and other issues should be fixed. Keep in mind that Ghostscript is also used to render/view PDF files. When interactively viewing it is common to do just-in-time rendering. Even for bulk conversions, conversion on a page-by-page basis will save resources when dealing with many pages. Alternatives do exist now for PDF due to Xpdf and the derived Poppler project and Poppler has become heavily used. Ghostscript is still more competent at rendering PDF than Poppler is. Ghostscript is able to deal with CMYK color spaces, per-object colorspaces, and transparency, and it is able to render to various quality levels (bilevel, grayscale, RGB, RGBA, CMYK) depending on the output driver selected. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.