You must act now!
The critical state of modern cyberspace has been confirmed once again by a new security vulnerability. This flaw affects Ghostscript, a widely used software for viewing, creating, and processing PostScript and PDF documents.
The vulnerability with the CVE number CVE-2023-36664 and a CVSS rating of 9.8 ("critical") allows a remote attacker to execute remote code.
What happens?
The security vulnerability 2023-248889-1012 allows an attacker to execute arbitrary code on the user's system using specially crafted PostScript files. This could potentially lead to data theft, system corruption, or the distribution of malware.
The criticality of this security vulnerability lies in its ease of exploitation and the number of systems that could be affected. The potential damage could be immense if no immediate action is taken.
The developers of Ghostscript have already released a patch for this vulnerability. It is therefore strongly recommended that all systems using the affected Ghostscript version be updated to the latest version.
System administrators and IT managers must take this security vulnerability seriously and implement immediate remediation measures. Because Ghostscript is so widespread, the potential attack surface is also large.
Who is affected?
The vulnerability affects all versions of Ghostscript prior to version 10.01.2, released on June 26 [GHOST2023a]. Since it is both an application and a library, any software that uses the library is also affected, so an update may be necessary.
Further information
The BSI has summarized all the important information in this document: Version 1.0: Critical vulnerability with proof-of-concept exploit in Ghostscript. Cybersecurity alert, security notice, July 14, 2023. Threat level 2 (Medium).
Patch management by SYNAXON
If you use our Managed RMM, we'll handle patch management for you. Our technicians are already trained and will prioritize updates to relevant software products as soon as they are released.