Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 30 May 2010 22:08:12 +0200
From: "Bernhard R. Link" <>
Subject: Re: CVE request: ghostscript and gv

* Florian Weimer <> [100530 21:53]:
> "gs -P- -DSAFER" works, too, so you can inject the payload
> with file-name-preserving user agents.  8-(
> Is the general consensus that we should patch this in
> viewers/Ghostscript wrappers, and not Ghostscript itself?

For Gv there is also the issue with (and the Debian lenny
version with the temporary filei creation stuff), so it needs to be fixed

Gs's -P- not working (at least for, is definitly a bug that
needs to be fixed.

I personally would also suggest fixing gs to not look in the current
directory by default (looking for important stuff in the current
directory is really always a bad idea). I guess the problem is how to
fix it.

I think (though I am not really sure) a gs that has -P- activated by
default would for example break pdf viewing of gv versions 3.6.2 to, because (I think) -P- also causes files in the current
directory can no longer be opened from other postscript files with
-dSAFER and the gv versions above only use -dSAFER and not -dDELAYSAFER
as it would need for generated files. (I think -P- already
has that effect, even though it has no effect on

	Bernhard R. Link

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.