3 ms·
Shell in the Ghost: Ghostscript CVE-2023-28879 writeup
- 1attice 4y agoThis is the most perfectly named CVE.
- selfmodruntime 4y agoIsn‘t it? I love that when compared to most other professions, people in computing can have a little fun with naming or by including bits of pop culture references in their work.
- selfmodruntime 4y agoGreat writeup. The more I learn about GhostScript / PostsScript / PDF‘s in general, the more I‘m amazed that such a complicated system can produce simple documents that are relied upon by billions of people. I feel when like compared to a lot of other consumer facing software, PDF‘s are an incredible achievement. 99% of the time, a PDF will look and work the exact same to every user regardless of their environment. They can be editable at the exact needed places and when I print them, I can be sure the result will look exactly as I expect. The only gripe I have with them is that while I can easily specify input fields, easily extracting that data isn‘t always as reliable.
- eviks 4y agoYour only gripe is an indication that the document is anything but simple
- selfmodruntime 4y agoAs I said, it‘s simple to use for consumers.
- eviks 4y agoWow, so consumers don't copy&paste?
- selfmodruntime 4y agoThey can. I was talking about automation.
- eviks 4y agoThey can't, line continuation is broken in pdf, so the most basic consumer operation like copy&paste a few paragraphs of text is broken since pdf is anything but a simple format No advanced stuff like automaton required
- pengaru 4y agoKind of horrifying to hear ghostscript is being invoked on untrusted inputs via the web... that program must have an endless supply of RCEs if one just looks.
- ftxbro 4y agoSo maybe this is off topic, but is anyone going around with GPT-4 to re-examine every single public source code for more new exploits yet?