Ghostscript and GraphicsMagick security

Tavis Ormandy has discovered many security weaknesses in Ghostscript. 
GraphicsMagick uses Ghostscript to read Postscript and PDF files, and 
to convert from some formats where an external program can be used to 
convert to Postscript or PDF, and then to a raster format (using 
Ghostscript) before being consumed as an image by GraphicsMagick. 
There should only be a security risk when GraphicsMagick is given a 
PDF or Postscript file directly as input.

The discussion topic may be read at 
"http://www.openwall.com/lists/oss-security/2016/10/05/7".

It is not clear to me at this time if the security issues found in 
Ghostscript are a concern when reading PDF files.

Sites which use GraphicsMagick (or other software depending on 
Ghostscript) to read Postscript files uploaded by untrusted users need 
to be aware of these issues and should take steps to protect their 
security.

Individuals should take care before opening untrusted Postscript files 
using GraphicsMagick or the many other programs which use Ghostscript 
to read Postscript files.

At this point in time it is not clear how most Ghostscript users will 
obtain a fixed version under a desired usage license.  Hopefully 
Ghostscript packages obtained from OS distributions will be updated 
via source patches.

Bob
-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot