Avatar for Username

Sykje yn Support

Mij stipescams. Wy sille jo nea freegje in telefoannûmer te beljen, der in sms nei ta te stjoeren of persoanlike gegevens te dielen. Meld fertochte aktiviteit mei de opsje ‘Misbrûk melde’.

Mear ynfo

Dizze konversaasje is argivearre. Stel in nije fraach as jo help nedich hawwe.

Ghostscript security vulnerabilities (CVE-2023-36664)

hannes.sakuth
hannes.sakuth
more options

Dear Mozilla Support,

Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability.

Can we please get some feedback regarding the following questions:

1. does Mozilla Firefox use the Ghostscript library with a version older than 10.01.2?

If this is the case, please answer the following questions:

2. is there already a patch, update or plan to fix the problem?

3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified?

4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available?

Thank you in advance for your time and assistance.


Yours sincerely, Hannes Sakuth

Dear Mozilla Support, Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability. Can we please get some feedback regarding the following questions: 1. does '''Mozilla Firefox''' use the Ghostscript library with a version older than 10.01.2? If this is the case, please answer the following questions: 2. is there already a patch, update or plan to fix the problem? 3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified? 4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available? Thank you in advance for your time and assistance. Yours sincerely, Hannes Sakuth

Bewurke troch hannes.sakuth op

Alle antwurden (2)

James
James
  • Moderator
  • Top 10 Contributor
more options

Only this and a thread for Thunderbird has any mention of Ghostscript in a support.mozilla.org search.

Only one bug came up in a search for Ghostscript on Bugzilla.mozilla.org mentioning Ghostscript and that was from a loooong time ago. For reading https://bugzilla.mozilla.org/show_bug.cgi?id=147274

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Firefox uses these libraries to work with PDFs:

For the built-in PDF viewer, pdf.js (https://github.com/mozilla/pdf.js)

For the "Save to PDF" destination when printing, Cairo (https://cairographics.org/)

As far as I know, these do not make calls to Ghostscript, although a Firefox user could configure Firefox to automatically launch PDFs in an external Ghostscript application (instead of the built-in viewer) if they wanted to.