Post

RedTeam Pentesting
@redteam-pentesting.de

🚨8 months after public disclosure, RHEL @almalinux.org @rockylinux.org are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!

0 reposts0 likes

RedTeam Pentesting
@redteam-pentesting.de

This is neither the first, nor the second time that we can't get distros to apply upstream fixes for publicly disclosed RCEs with POCs available in Ghostscript. x.com/RedTeamPT/st...

x.comRedTeam Pentesting on X: "🚨 Another month, another critical Ghostscript RCE, with patches rolling out rather slowly to some distros again 👻😱 #infosec #DeprecateUntrustedPostscript" / X🚨 Another month, another critical Ghostscript RCE, with patches rolling out rather slowly to some distros again 👻😱 #infosec #DeprecateUntrustedPostscript
RedTeam Pentesting
@redteam-pentesting.de

Thanks for the hint! However, we think this is a systemic problem that should be fixed as close to the source as possible, especially since the upstream distribution is a commercial one and patches are available.

AlmaLinux
@almalinux.org

“As close to the source as possible…” if we’re pulling from the source, how is that different from Red Hat pulling it in? I realize it would be ideal for it to be patched for the entire RHEL ecosystem, but since that hasn’t happened don’t you want to at least help protect whoever you can?

RedTeam Pentesting
@redteam-pentesting.de

That's correct. We assumed that you are pulling security updates from Red Hat and therefore either rely on their handling of CVEs or follow the bug tracker or mailing lists yourselves. You can simply apply the fix that was published by Ghostscript earlier this year.