[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1810170816290.3841@freddy.simplesystems.org>
Date: Wed, 17 Oct 2018 08:30:43 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ghostscript: 1Policy operator gives access to
.forceput CVE-2018-18284
On Wed, 17 Oct 2018, Rich Felker wrote:
>>
>> Even with the easy to exploit stuff compiled out (which upstream do not
>> support), I haven't been bothering to get CVE's for all the memory
>> corruption or UaF I've been reporting, because nobody can keep up with
>> these operator leaks anyway.
>
> An obvious fix for UaF's would be just removing the frees. Use of gs
> as an interactive program where leaks would matter is a historical
> curiosity; the only meaningful modern use is as a converter.
Memory allocations would build to extremely large values across
hundreds of rendered pages. Use of Ghostscript in interactive
programs is still surely common. Programs using libgs will inherit
any leaks. These leaks and other issues should be fixed.
Keep in mind that Ghostscript is also used to render/view PDF files.
When interactively viewing it is common to do just-in-time rendering.
Even for bulk conversions, conversion on a page-by-page basis will
save resources when dealing with many pages.
Alternatives do exist now for PDF due to Xpdf and the derived Poppler
project and Poppler has become heavily used.
Ghostscript is still more competent at rendering PDF than Poppler is.
Ghostscript is able to deal with CMYK color spaces, per-object
colorspaces, and transparency, and it is able to render to various
quality levels (bilevel, grayscale, RGB, RGBA, CMYK) depending on the
output driver selected.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
