Ghostscript Insecure

Ghostscript is very powerful and complex software which is difficult 
to make secure.  Due to licensing issues, many users have not updated 
to more recent Ghostscript releases which may or may not be more 
secure than older releass.

GraphicsMagick and ImageMagick use Ghostscript to render Postscript 
(including EPS) and PDF files.  They also use Ghostscript to render 
the Postscript from some external utilities which convert from some 
format to Postscript or PDF.  Users of Ghostscript could be 
compromised if they open an untrusted file.

Tavis Ormandy has spent some time researching Ghostscript issues and 
it took only a few hours for him to find several issues.  Today he 
made this posting to the oss-security list:

   http://www.openwall.com/lists/oss-security/2018/08/21/2

In which he says "TL;DR: I *strongly* suggest that distributions start 
disabling PS, EPS, PDF and XPS coders in policy.xml by default."

GraphicsMagick does not currently offer a "policy.xml" configuration 
file as Tavis describes.

To assure that Ghostscript can not be executed by GraphicsMagick, edit 
the installed delegates.mgk (config/delegates.mgk.in in the source 
tree), or place an edited copy where GraphicsMagick will find it 
first.  The MAGICK_CONFIGURE_PATH environment variable may be used to 
influence where GraphicsMagick looks for delegates.mgk.

Comment or delete all lines containing the string "@PSDelegate@".

Use 'gm convert -list delegate' to see the delegate definitions which 
still remain.

Unfortunately, many formats depending on the delegate subsystem also 
depend on Postscript or PDF so they will stop working.

A fool-proof way to assure that Ghostscript is not used is to simply 
uninstall it from your system.

Bob
-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot