>> While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability. >> >> The person who did is Wunderfund CTO and fou

>> While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability. >> >> The person who did is Wunderfund CTO and founder Emil Lerner, who found the bug last year and used it to obtain bug bounties from companies like Airbnb, Dropbox, and Yandex. > > Folks are not obligated to donate their time. When it comes to open-source, I think this is a weak argument. While I consider your statement true, it's a "glass half-empty" way of looking at working together to build useful software. Releasing an exploit before a fix is applied also negates work other people have put into the project. It's surprising to me that neither Lerner, nor any of the downstream companies, upstreamed the fix in a year's time. If true that none tried, as you point out. > Details about the vulnerability leaked into the public domain last month after Lerner held a talk at the ZeroNight X security conference about the current attack vector posed by server-side image conversion tools and used the Ghostscript zero-day as an example.