[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJ_zFkL5wLrabBXB6JSUhxwG6UVmYrCYOJYhw1rBeC=3dAdF=g@mail.gmail.com>
Date: Wed, 22 Aug 2018 20:33:37 -0700
From: Tavis Ormandy <taviso@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: More Ghostscript Issues: Should we disable PS
coders in policy.xml by default?
On Wed, Aug 22, 2018 at 2:17 PM Bob Friesenhahn <
bfriesen@...ple.dallas.tx.us> wrote:
> The CERT advisory at https://www.kb.cert.org/vuls/id/332928 provides a
> policy.xml example which does not appear to block PS2 and PS3, which
> are also entry points for reading Postscript.
>
>
I think (luckily) there's no magic that will invoke those, but I think
you're right, for completeness they should be disabled by default as well.
Tavis.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
