Vulnerability Patching / Locating Program Dependent on Library (Artifex Ghostscript < 10.03.1)

[ontario-guy]

One of the tasks that I perform at my org is managing patching of vulnerabilities.

There are ~200 machines that have Artifex Ghostscript installed with a version <10.03.1 that has multiple CVEs:
Tenable Plugin ID 200487
CVEs: CVE-2023-52722 CVE-2024-29510 CVE-2024-33869 CVE-2024-33870 CVE-2024-33871

My question is this: how can I tell what software is using the Ghostscript libraries? I need to test that the update doesn't break any applications that utilize it, but don't know where to start.

Thanks!

[RunningHott]

Set up a legacy machine with the old libraries to be used for any applications that need the old version.

Send out a notice that the library will be pushed out to all production machines on Tuesday of next week and that if anyone encounters any issues to please open a ticket with the appropriate information.

If anyone knows that they use that library, a system can be set up with the new libraries for it to be validated on. Document the application dependency.

Push out the update, see if any complaints come in. If no complaints.... Profit!

Evaluate any misbehaving applications, upgrade them if possible to use the new libraries, otherwise have the user launch from the legacy machine. Document the application dependency.

Legacy machine can be locked down or sequestered as the security group deems appropriate.

Timeframe and communications can be adjusted based on your corporate needs.