Avatar for Username

ძიება მხარდაჭერაში

ნუ გაებმებით თაღლითების მახეში მხარდაჭერის საიტზე. აქ არასდროს მოგთხოვენ სატელეფონო ნომერზე დარეკვას, შეტყობინების გამოგზავნას ან პირადი მონაცემების გაზიარებას. გთხოვთ, გვაცნობოთ რამე საეჭვოს შემჩნევისას „დარღვევაზე მოხსენების“ მეშვეობით.

ვრცლად

ეს თემა დაარქივებულია. დასვით ახალი კითხვა, თუ დახმარება გესაჭიროებათ.

Ghostscript security vulnerabilities (CVE-2023-36664)

  • 2 პასუხი
  • 0 მომხმარებელი წააწყდა მსგავს სიძნელეს
  • 1 ნახვა
  • ბოლოს გამოეხმაურა jscher2000 - Support Volunteer

hannes.sakuth
hannes.sakuth
more options

Dear Mozilla Support,

Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability.

Can we please get some feedback regarding the following questions:

1. does Mozilla Firefox use the Ghostscript library with a version older than 10.01.2?

If this is the case, please answer the following questions:

2. is there already a patch, update or plan to fix the problem?

3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified?

4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available?

Thank you in advance for your time and assistance.


Yours sincerely, Hannes Sakuth

Dear Mozilla Support, Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability. Can we please get some feedback regarding the following questions: 1. does '''Mozilla Firefox''' use the Ghostscript library with a version older than 10.01.2? If this is the case, please answer the following questions: 2. is there already a patch, update or plan to fix the problem? 3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified? 4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available? Thank you in advance for your time and assistance. Yours sincerely, Hannes Sakuth

ჩასწორების თარიღი: , ავტორი: hannes.sakuth

ყველა პასუხი (2)

James
James
  • Moderator
  • Top 10 Contributor
more options

Only this and a thread for Thunderbird has any mention of Ghostscript in a support.mozilla.org search.

Only one bug came up in a search for Ghostscript on Bugzilla.mozilla.org mentioning Ghostscript and that was from a loooong time ago. For reading https://bugzilla.mozilla.org/show_bug.cgi?id=147274

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Firefox uses these libraries to work with PDFs:

For the built-in PDF viewer, pdf.js (https://github.com/mozilla/pdf.js)

For the "Save to PDF" destination when printing, Cairo (https://cairographics.org/)

As far as I know, these do not make calls to Ghostscript, although a Firefox user could configure Firefox to automatically launch PDFs in an external Ghostscript application (instead of the built-in viewer) if they wanted to.