Adobe addresses over 60 vulnerabilities in multiple products
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40722 | AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abu AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE. NVD description · AI analysis pending | 9.8 group max | 3% |
| — | ||
| CVE-2021-43018 | Adobe Photoshop versions 23.0.2 and 22.5.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in t Adobe Photoshop versions 23.0.2 and 22.5.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPG file. NVD description · AI analysis pending | 7.8 | <1% |
| — |
Full article376 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 14, 2021
Adobe warns of threat actors that could exploit critical vulnerabilities in multiple products running on Windows and macOS systems.
Adobe has issued critical warnings for more than 60 vulnerabilities in multiple products running on Windows and macOS machines.
The vulnerabilities can be exploited by threat actors for code execution, privilege escalation and denial-of-service attacks.
The company said it was not aware of in-the-wild exploitation of any of the documented vulnerabilities.
Adobe has addressed three critical and important vulnerabilities in Photoshop for Windows and macOS. An attacker could trigger these flaws for arbitrary code execution and memory leak in the context of the current user.
Below are the vulnerability details:
| Vulnerability Category | Vulnerability Impact | Severity | CVSS base score | CVSS vector | CVE Number |
|---|---|---|---|---|---|
| Out-of-bounds Write (CWE-787) | Arbitrary code execution | Critical | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CVE-2021-43018 |
| Access of Memory Location After End of Buffer (CWE-788) | Memory Leak | Important | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | CVE-2021-43020 |
| Buffer Overflow (CWE-120) | Arbitrary code execution | Critical | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CVE-2021-44184 |
CVE-2021-43018 has been reported by Mat Powell working with Trend Micro Zero Day Initiative, while CVE-2021-43020 and CVE-2021-44184 have been reported by Kushal Arvind Shah of Fortinet’s FortiGuard Labs.
Adobe also fixed multiple code execution vulnerabilities in the Adobe Experience Manager:
| Vulnerability Category | Vulnerability Impact | Severity | CVSS base score | CVSS vector | CVE Number |
|---|---|---|---|---|---|
| Cross-site Scripting (XSS)(CWE-79) | Arbitrary code execution | Critical | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | CVE-2021-43761 |
| Improper Restriction of XML External Entity Reference (‘XXE’) (CWE-611) | Arbitrary code execution | Critical | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CVE-2021-40722 |
| Improper Input Validation (CWE-20) | Security feature bypass | Important | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CVE-2021-43762 |
| Cross-site Scripting (XSS)(CWE-79) | Arbitrary code execution | Critical | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | CVE-2021-43764 |
| Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | Critical | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | CVE-2021-43765 |
| Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | Critical | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | CVE-2021-44176 |
| Cross-site Scripting (Stored XSS) (CWE-79) | Arbitrary code execution | Critical | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | CVE-2021-44177 |
| Cross-site Scripting (Reflected XSS) (CWE-79) | Arbitrary code execution | Important | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N | CVE-2021-44178 |
The good news is that Adobe’s Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploring these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Adobe)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/125640/security/adobe-60-vulnerabilities-multiple-products.html