Saint GhostButt, Ghost Inside Ghostscript

Patron of servers that convert documents, PostScript files sent by strangers, and the -dSAFER option that was not so safe.

Life

In May 2017 a researcher showed ghostbutt (CVE-2017-8291): in Ghostscript, the PostScript interpreter half the world uses to convert documents, a crafted file bypassed -dSAFER mode and, with a %pipe% in the output filename, ran commands on the system. Because ImageMagick and many others called Ghostscript behind the scenes, simply having an image processed was enough to fall into the trap.

Prayer

O Saint GhostButt, who steps out of the document and into the shell, let our interpreters stay within their bounds. Amen.

How to celebrate

Celebrated by updating Ghostscript and taking PostScript processing away from those who do not need it.

Open a stranger's document, run a hidden command.