Ghostscript security research (write-up series)

Through pentest work at Codean Labs, I found that Ghostscript is unexpectedly part of many attack surfaces, even server-side: applications that process user-submitted documents or images may invoke ImageMagick or LibreOffice for conversion, which in turn may call into Ghostscript for (embedded) EPS images. Hence, I went digging and found a bunch of memory corruption bugs, several logic bugs and a…