#ghostscriptbug #cve-2023-36664: exploring the pipe-based attack vulnerability

Source: https://nakedsecurity.sophos.com/2023/07/04/ghostscript-bug-could-allow-rogue-documents-to-run-system-commands/

I’ve summarised this article for you:

Jeremy Clarkson’s opinionated summary of Ghostscript:
Ghostscript is a widely used, free and open-source implementation of PostScript and the PDF file format. It is used by a plethora of software and cloud services, and is a great example of how open-source software can be a powerful and reliable tool. Unfortunately, it had a vulnerability, CVE-2023-36664, that allowed malicious actors to run system commands through its rendering engine. This was fixed with careful coding and testing, but not without a few hiccups along the way.

Bulletpoints:
– Ghostscript is a free and open-source implementation of Adobe’s PostScript and PDF file format
– Used by many software and cloud services
– Had a vulnerability (CVE-2023-36664) allowing malicious actors to run system commands through its rendering engine
– Careful coding and testing required to fix the vulnerability, with a few hiccups along the way