Adobe warns of threat actors that could exploit critical vulnerabilities in multiple products running on Windows and macOS systems.

Adobe has issued critical warnings for more than 60 vulnerabilities in multiple products running on Windows and macOS machines.

The vulnerabilities can be exploited by threat actors for code execution, privilege escalation and denial-of-service attacks.

The company said it was not aware of in-the-wild exploitation of any of the documented vulnerabilities.

Adobe has addressed three  critical  and important vulnerabilities in Photoshop for Windows and macOS. An attacker could trigger these flaws for arbitrary code execution and memory leak in the context of the current user.   

Below are the vulnerability details:

Vulnerability CategoryVulnerability ImpactSeverityCVSS base score CVSS vectorCVE NumberOut-of-bounds Write (CWE-787)Arbitrary code executionCritical7.8  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-43018 Access of Memory Location After End of Buffer (CWE-788)Memory LeakImportant5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2021-43020Buffer Overflow (CWE-120)Arbitrary code executionCritical7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2021-44184CVE-2021-43018 has been reported by Mat Powell working with Trend Micro Zero Day Initiative, while CVE-2021-43020 and CVE-2021-44184 have been reported by Kushal Arvind Shah of Fortinet’s FortiGuard Labs.

Adobe also fixed multiple code execution vulnerabilities in the Adobe Experience Manager:

Vulnerability CategoryVulnerability ImpactSeverityCVSS base score CVSS vectorCVE Number Cross-site Scripting (XSS)(CWE-79)Arbitrary code executionCritical8.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2021-43761Improper Restriction of XML External Entity Reference (‘XXE’) (CWE-611)Arbitrary code executionCritical9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-40722Improper Input Validation (CWE-20)Security feature bypassImportant6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2021-43762 Cross-site Scripting (XSS)(CWE-79)Arbitrary code executionCritical8.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVE-2021-43764Cross-site Scripting (Stored XSS) (CWE-79)Arbitrary code executionCritical8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVE-2021-43765 Cross-site Scripting (Stored XSS) (CWE-79)Arbitrary code executionCritical8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVE-2021-44176Cross-site Scripting (Stored XSS) (CWE-79)Arbitrary code executionCritical8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVE-2021-44177 Cross-site Scripting (Reflected XSS) (CWE-79)Arbitrary code executionImportant5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCVE-2021-44178The good news is that Adobe’s Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploring these vulnerabilities.

Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, Adobe)

The post Adobe addresses over 60 vulnerabilities in multiple products appeared first on Security Affairs.