Ghostscript security vulnerabilities (CVE-2023-36664)
Dear Mozilla Support,
Earlier this week we learned about the Ghostscript vulnerability (CVE-2023-36664) and since the security of the systems and data we support is our highest priority, we would like to ensure that the software you provide is not affected by this vulnerability.
Can we please get some feedback regarding the following questions:
1. does Mozilla Firefox use the Ghostscript library with a version older than 10.01.2?
If this is the case, please answer the following questions:
2. is there already a patch, update or plan to fix the problem?
3. if there is or is planned to be a patch, when is it expected to be available and how will users be notified?
4. are there any specific actions or temporary fixes we can take to minimize the risk until a final fix is available?
Thank you in advance for your time and assistance.
Yours sincerely,
Hannes Sakuth
由 hannes.sakuth 於 修改
所有回覆 (2)
Only this and a thread for Thunderbird has any mention of Ghostscript in a support.mozilla.org search.
Only one bug came up in a search for Ghostscript on Bugzilla.mozilla.org mentioning Ghostscript and that was from a loooong time ago. For reading https://bugzilla.mozilla.org/show_bug.cgi?id=147274
Firefox uses these libraries to work with PDFs:
For the built-in PDF viewer, pdf.js (https://github.com/mozilla/pdf.js)
For the "Save to PDF" destination when printing, Cairo (https://cairographics.org/)
As far as I know, these do not make calls to Ghostscript, although a Firefox user could configure Firefox to automatically launch PDFs in an external Ghostscript application (instead of the built-in viewer) if they wanted to.