Questo sito potrebbe offrire funzionalità limitate durante le operazioni di manutenzione per migliorare l'esperienza utente. Se un articolo non risolve il tuo problema e vuoi richiedere supporto, la nostra comunità di supporto è pronta ad aiutarti tramite @FirefoxSupport su Twitter e /r/firefox su Reddit.

Avatar for Username

Cerca nel supporto

Attenzione alle mail truffa. Mozilla non chiederà mai di chiamare o mandare messaggi a un numero di telefono o di inviare dati personali. Segnalare qualsiasi attività sospetta utilizzando l'opzione “Segnala abuso”.

Ulteriori informazioni

Questa discussione è archiviata. Inserire una nuova richiesta se occorre aiuto.

Ghostscript security vulnerabilities (CVE-2023-36664)

hannes.sakuth
hannes.sakuth
more options

Dear Mozilla Support,

Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability.

Can we please get some feedback regarding the following questions:

1. does Mozilla Firefox use the Ghostscript library with a version older than 10.01.2?

If this is the case, please answer the following questions:

2. is there already a patch, update or plan to fix the problem?

3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified?

4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available?

Thank you in advance for your time and assistance.


Yours sincerely, Hannes Sakuth

Dear Mozilla Support, Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability. Can we please get some feedback regarding the following questions: 1. does '''Mozilla Firefox''' use the Ghostscript library with a version older than 10.01.2? If this is the case, please answer the following questions: 2. is there already a patch, update or plan to fix the problem? 3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified? 4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available? Thank you in advance for your time and assistance. Yours sincerely, Hannes Sakuth

Modificato da hannes.sakuth il

Tutte le risposte (2)

James
James
  • Top 25 Contributor
  • Moderator
more options

Only this and a thread for Thunderbird has any mention of Ghostscript in a support.mozilla.org search.

Only one bug came up in a search for Ghostscript on Bugzilla.mozilla.org mentioning Ghostscript and that was from a loooong time ago. For reading https://bugzilla.mozilla.org/show_bug.cgi?id=147274

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Firefox uses these libraries to work with PDFs:

For the built-in PDF viewer, pdf.js (https://github.com/mozilla/pdf.js)

For the "Save to PDF" destination when printing, Cairo (https://cairographics.org/)

As far as I know, these do not make calls to Ghostscript, although a Firefox user could configure Firefox to automatically launch PDFs in an external Ghostscript application (instead of the built-in viewer) if they wanted to.