Hacker News Reader

Comment by cesarb | Hacker News Reader

How many PDF.js security vulnerabilities have been found so far?

A quick Google search found only four:

https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure)

https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable)

https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combined with a separate vulnerability" to be exploitable)

https://www.mozilla.org/en-US/security/advisories/mfsa2015-7... (this one)

It still is looking better than the plugin it replaced.

View on HN

Tech lead of pdf.js here: All of the above exploits were issues with extension code in firefox, i.e. other extensions could have these issues too. If you were to use the web only version of pdf.js none of these exploits would apply.

Just to clarify... were the vulnerabilities in Firefox itself? Or were they in the extension?

>It still is looking better than the plugin it replaced.

Exploiting a bug in a memory unsafe language is much harder than writing some JavaScript. It is also much less reliable and platform specific.

The real question is why the hell is Firefox not sandboxed?

If you enable e10s in nightly it is I suppose thats coming up eventually to a releaae near you

It can be with Firejail: https://l3net.wordpress.com/projects/firejail/

> It still is looking better than the plugin it replaced.

Not for long if this keeps up…

For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so that number should be much higher. I think pdf.js does just fine.

pdf.js does a lot less, of course. Really you should compare Firefox to Acrobat, as they are both rich media rendering apps with a lot of functionality.

pdf.js does a lot less, just how I like it. I can view PDFs and not have a constant stream of critical vulnerabilities to worry about.

Did you know Acrobat supports viewing 3D models in PDFs? Not even kidding[1]. It has an unnecessarily huge attack surface.

I will never use that and I work in engineering at a factory.

[1] For example, http://help.actify.com/download/attachments/6651965/SF_expor...

Pdf.js does less, but in most cases it does all the things users ever wanted from Acrobat, so the comparison is sound.

One of the points of something like pdf.js is that in most cases you don't need all that extra fluff. You just want to look at some PDF. So doing less is exactly what allows pdf.js to be (more) secure.

>CVEs haven't been maintained since the early 90s

Can you clarify what you mean by this?

The wording was confusing for me too. At first reading I understood it as saying CVEs were no longer being issued for Acrobat, which definitely isn't the case. I assume the intended meaning was that Acrobat was first released in 1993[0], but the first CVE was CVE-1999-0001 (source: downloaded the raw dump from [1], ran grep -m1 CVE-....-0001).

But, I'm doubtful there would have been all that many CVEs issued for Acrobat from 1993-1998. There was only one CVE that mentioned "Acrobat" each year from 1999-2001, and three in 2002. The more recent years are the fun ones - but I have no idea whether that's a result of freshly-introduced exploitable bugs or just increased attention.

[0]: https://en.wikipedia.org/wiki/Adobe_Acrobat_version_history

[1]: https://cve.mitre.org/data/downloads/index.html

SumatraPDF is the only reasonable way to view a PDF safely.

http://www.sumatrapdfreader.org/free-pdf-reader.html

Not perfect but definitely not adobe or foxit and way safer than viewing in any browser.

What makes Sumatra safer than other FOSS PDF viewers like evince, okular, epdf, etc.?

Market share... and ignorance of users :)

It doesn't try to execute javascript and whatever else is in PDF these days.

Exactly!

Sumatra is written in a memory-unsafe language and runs unsandboxed natively. Why should I trust it?

Browsers are at least sandboxed and have heavily scrutinised codebases.

Reply on news.ycombinator.com