TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Shell in the Ghost: Ghostscript CVE-2023-28879 writeup

50 pointsby notmine1337about 2 years ago

4 comments

j-kriegerabout 2 years ago
Great writeup. The more I learn about GhostScript &#x2F; PostsScript &#x2F; PDF‘s in general, the more I‘m amazed that such a complicated system can produce simple documents that are relied upon by billions of people.<p>I feel when like compared to a lot of other consumer facing software, PDF‘s are an incredible achievement. 99% of the time, a PDF will look and work the exact same to every user regardless of their environment. They can be editable at the exact needed places and when I print them, I can be sure the result will look exactly as I expect.<p>The only gripe I have with them is that while I can easily specify input fields, easily extracting that data isn‘t always as reliable.
评论 #35534527 未加载
1atticeabout 2 years ago
This is the most perfectly named CVE.
评论 #35533643 未加载
pengaruabout 2 years ago
Kind of horrifying to hear ghostscript is being invoked on untrusted inputs via the web... that program must have an endless supply of RCEs if one just looks.
ftxbroabout 2 years ago
So maybe this is off topic, but is anyone going around with GPT-4 to re-examine every single public source code for more new exploits yet?