Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

> PDF runs software and that means that everything under the sun including malware and DRM can run on PDF -- and indeed that has occurred many times.

You can basically avoid this problem by only opening PDFs in programs like Preview and Evince, and never Acrobat.

View on HN

> You can basically avoid this problem by only opening PDFs in programs like Preview and Evince, and never Acrobat.

Except some bank forms won't work [1], because someone, at some point in history, thought it was a great idea to embed phone-home DRM and "security" into PDFs.

[1] e.g. this form from Standard Chartered https://av.sc.com/sg/content/docs/BusinessBankingSmartAccoun...

Not really:

https://www.cvedetails.com/product/23592/Gnome-Evince.html

Having vulnerabilities is never great. However, this is a separate issue from whether the PDF reader explicitly allows code execution or supports some of the more obscure PDF extensions, which is what the parent was talking about.

isnt including fonts basically code execution in and of itself?

Aside from potential vulnerabilities (bugs), no. Font formats are declarative. The various tables that define conditionals et al have no ability to run arbitrary code, and certainly do not have any concept of scripting and the like.

Ttf has bytecode for a stack interpreter with conditionals and loops (jump instructions and loop all). That’s declarative in the sense that all code is data, but i would say it is imperative.

Yes but it is a strict set of very limited codes, nothing which gains access to the machine a la syscalls.

Well... https://www.extremetech.com/internet/308167-windows-zero-day...

First line says "except vulnerabilities".

Reply on news.ycombinator.com