Re: CVE request: ghostscript and gv

["Bernhard R. Link" <brlink () debian org>]

* Florian Weimer <fw () deneb enyo de> [100530 21:53]:
> "gs -P- -DSAFER gs_init.ps" works, too, so you can inject the payload
> with file-name-preserving user agents.  8-(
>
> Is the general consensus that we should patch this in
> viewers/Ghostscript wrappers, and not Ghostscript itself?

For Gv there is also the issue with pdf2dsc.ps (and the Debian lenny
version with the temporary filei creation stuff), so it needs to be fixed
anyway.

Gs's -P- not working (at least for gs_init.ps), is definitly a bug that
needs to be fixed.

I personally would also suggest fixing gs to not look in the current
directory by default (looking for important stuff in the current
directory is really always a bad idea). I guess the problem is how to
fix it.

I think (though I am not really sure) a gs that has -P- activated by
default would for example break pdf viewing of gv versions 3.6.2 to
3.6.5.91, because (I think) -P- also causes files in the current
directory can no longer be opened from other postscript files with
-dSAFER and the gv versions above only use -dSAFER and not -dDELAYSAFER
as it would need for pdf2dsc.ps generated files. (I think -P- already
has that effect, even though it has no effect on gs_init.ps).

        Bernhard R. Link