3 ms·
Having vulnerabilities is never great. However, this is a separate issue from whether the PDF reader explicitly allows code execution or supports some of the mo
by tjohns 6y ago
Having vulnerabilities is never great. However, this is a separate issue from whether the PDF reader explicitly allows code execution or supports some of the more obscure PDF extensions, which is what the parent was talking about.
- dec0dedab0de 6y agoisnt including fonts basically code execution in and of itself?
- junon 6y agoAside from potential vulnerabilities (bugs), no. Font formats are declarative. The various tables that define conditionals et al have no ability to run arbitrary code, and certainly do not have any concept of scripting and the like.
- dialamac 6y agoTtf has bytecode for a stack interpreter with conditionals and loops (jump instructions and loop all). That’s declarative in the sense that all code is data, but i would say it is imperative.
- junon 6y agoYes but it is a strict set of very limited codes, nothing which gains access to the machine a la syscalls.
- cratermoon 6y agoWell... https://www.extremetech.com/internet/308167-windows-zero-day-attack-lets-hackers-hide-malicious-code-in-fonts https://www.extremetech.com/internet/308167-windows-zero-day...
- junon 6y agoFirst line says "except vulnerabilities".