4 ms·

I used to deal with PDF at my day job. Among all the tools we use in production, Ghostscript probably has the most 0 day. Thankfully we're paranoid about securi

I used to deal with PDF at my day job. Among all the tools we use in production, Ghostscript probably has the most 0 day. Thankfully we're paranoid about security and run everything in sandbox. Still it's no fun getting nagged by security to upgrade our Ghostscript version.

cjbprime 7y ago
It's funny how they all seem to have been found by one person (Tavis Ormandy) too. It's like the setup and PostScript standard are so baroque that only one human understands them, and that human takes a week or so every year or two to research and drop another 0day. https://bugs.chromium.org/p/project-zero/issues/detail?id=1640 https://bugs.chromium.org/p/project-zero/issues/detail?id=16...
- deleted 7y ago
  [deleted]
- ageitgey 7y ago
  Honestly it is starting to feel like most major exploits in most major software/platforms are being found by Tavis Ormandy these days. He's really good at what he does.
- NKCSS 7y ago
  Well, Tavis is one of the infosec superstars, the amount of stuff he comes up with is amazing.