Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

[Tavis Ormandy <taviso () google com>]

On Tue, Oct 16, 2018 at 12:57 PM Perry E. Metzger <perry () piermont com>
wrote:

> On Tue, 16 Oct 2018 11:06:14 -0700 Tavis Ormandy <taviso () google com>
> wrote:
> > Side note: I'm done looking at ghostscript for now, but still
> > *strongly* recommend that we deprecate untrusted postscript and
> > disable ghostscript coders by default in policy.xml.
>
> Again, given that PostScript is an archival format for a lot of
> documents, wouldn't a version of ghostscript with all the ability to
> do anything dangerous removed from the interpreter at compile time be
> rational?
We have to work with what we've got.

Even with the easy to exploit stuff compiled out (which upstream do not
support), I haven't been bothering to get CVE's for all the memory
corruption or UaF I've been reporting, because nobody can keep up with
these operator leaks anyway.

Tavis.