Posted on Leave a comment

VU#332928: Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities

Ghostscript contains an optional -dSAFER option,which is supposed to prevent unsafe PostScript operations. Multiple PostScript operations bypass the protections provided by -dSAFER,which can allow an attacker to execute arbitrary commands with arbitrary arguments. This vulnerability can also be exploited in applications that leverage Ghostscript,such as ImageMagick,GraphicsMagick,evince,Okular,Nautilus,and others. Exploit code for this vulnerability is publicly available.

What are your thoughts?