Join the AMA (Ask Me Anything) with the Firefox leadership team to celebrate Firefox 20th anniversary and discuss Firefox’s future on Mozilla Connect. Mark your calendar on Thursday, November 14, 18:00 - 20:00 UTC!

This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Ghostscript security vulnerabilities (CVE-2023-36664)

hannes.sakuth
hannes.sakuth
more options

Dear Mozilla Support,

Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability.

Can we please get some feedback regarding the following questions:

1. does Mozilla Firefox use the Ghostscript library with a version older than 10.01.2?

If this is the case, please answer the following questions:

2. is there already a patch, update or plan to fix the problem?

3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified?

4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available?

Thank you in advance for your time and assistance.


Yours sincerely, Hannes Sakuth

Dear Mozilla Support, Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability. Can we please get some feedback regarding the following questions: 1. does '''Mozilla Firefox''' use the Ghostscript library with a version older than 10.01.2? If this is the case, please answer the following questions: 2. is there already a patch, update or plan to fix the problem? 3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified? 4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available? Thank you in advance for your time and assistance. Yours sincerely, Hannes Sakuth

Modified by hannes.sakuth

All Replies (2)

James
James
  • Top 25 Contributor
  • Moderator
more options

Only this and a thread for Thunderbird has any mention of Ghostscript in a support.mozilla.org search.

Only one bug came up in a search for Ghostscript on Bugzilla.mozilla.org mentioning Ghostscript and that was from a loooong time ago. For reading https://bugzilla.mozilla.org/show_bug.cgi?id=147274

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Firefox uses these libraries to work with PDFs:

For the built-in PDF viewer, pdf.js (https://github.com/mozilla/pdf.js)

For the "Save to PDF" destination when printing, Cairo (https://cairographics.org/)

As far as I know, these do not make calls to Ghostscript, although a Firefox user could configure Firefox to automatically launch PDFs in an external Ghostscript application (instead of the built-in viewer) if they wanted to.