Adobe releases a new set of out-of-band patches for its products

Adobe has released a second out-of-band security update to address critical vulnerabilities affecting several products. 

Adobe has released a second out-of-band security update to fix critical vulnerabilities that impact numerous products of the IT giant. 

The flaws impact Adobe Illustrator, Dreamweaver, Marketo, Animate, After Effects, Photoshop, Premiere Pro, Media Encoder, InDesign, and the Creative Cloud desktop application on Windows and macOS machines. 

Adobe has released seven critical vulnerabilities in Illustrator, including memory corruption and out of bounds read/write issues that can lead to arbitrary code execution. 

Below the vulnerability details:

Vulnerability CategoryVulnerability ImpactSeverityCVE NumbersOut-of-Bounds ReadArbitrary code execution  CriticalCVE-2020-24409CVE-2020-24410Out-of-Bounds WriteArbitrary code execution CriticalCVE-2020-24411Memory Corruption    Arbitrary Code Execution    Critical CVE-2020-24412CVE-2020-24413CVE-2020-24414CVE-2020-24415Adobe has addressed an “important” uncontrolled search path element security flaw in Dreamweaver which could be exploited by attackers to escalate privilege.

Vulnerability CategoryVulnerability ImpactSeverityCVE NumbersUncontrolled Search Path Element Privilege Escalation ImportantCVE-2020-24425The company fixed four critical vulnerabilities in Animate, they are out-of-bounds read, stack overflow, and double-free flaws that can result in arbitrary code execution.  

Vulnerability CategoryVulnerability ImpactSeverityCVE NumbersDouble-freeArbitrary code executionCriticalCVE-2020-9747Stack-based buffer overflowArbitrary code executionCriticalCVE-2020-9748Out-of-bounds readArbitrary code executionCriticalCVE-2020-9749CVE-2020-9750

Adobe addressed an “important” XSS issue impacting the Marketo Sales Insight Salesforce package that could have been weaponized to deploy malicious JavaScript in a browser session. 

 Vulnerability Category Vulnerability ImpactSeverityCVE numbersCross-site Scripting (stored) JavaScript execution in the browserImportantCVE-2020-24416The company addressed

Vulnerability details

Vulnerability CategoryVulnerability ImpactSeverityCVE NumbersOut-of-Bounds Read Arbitrary Code Execution     Critical  CVE-2020-24418Uncontrolled search pathArbitrary Code Execution       CriticalCVE-2020-24419Adobe addressed a single out-of-bounds read and an uncontrolled search path critial flaws in After Effects that could lead to the execution of malicious code are now patched. 

Vulnerability CategoryVulnerability ImpactSeverityCVE NumbersOut-of-Bounds Read Arbitrary Code Execution     Critical  CVE-2020-24418Uncontrolled search pathArbitrary Code Execution       CriticalCVE-2020-24419Adobe has fixed a critical memory corruption flaw in InDesign that could also be exploited to execute arbitrary code. 

Vulnerability CategoryVulnerability ImpactSeverityCVE NumberMemory Corruption Arbitrary Code ExecutionCriticalCVE-2020-24421The company also fixed other critical uncontrolled search path issues in Photoshop, Premiere Pro, Media Encoder, and Creative Cloud installer for desktop.

Last week, Adobe released a separate set of out-of-band security patches affecting the Magento platform.

window._mNHandle = window._mNHandle || {};
window._mNHandle.queue = window._mNHandle.queue || [];
medianet_versionId = “3121199”;

try {
window._mNHandle.queue.push(function () {
window._mNDetails.loadTag(“762221962”, “300×250”, “762221962”);
});
}
catch (error) {}

Pierluigi Paganini

(SecurityAffairs – hacking, code execution)

The post Adobe releases a new set of out-of-band patches for its products appeared first on Security Affairs.