Adobe releases out-of-band patches for critical issues in Acrobat Reader, Photoshop, Bridge, ColdFusion
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-3794 +1 in the same advisory: …3761 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subdirectory. NVD description · AI analysis pending | 9.8 group max | 7% |
| — | ||
| CVE-2020-3766 | Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability. Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2020-3769 | Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure. NVD description · AI analysis pending | 7.5 | 3% |
| — | ||
| CVE-2020-3775 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution. NVD description · AI analysis pending | 9.8 group max | 5% |
| — | ||
| CVE-2020-3805 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.3 Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution . NVD description · AI analysis pending | 9.8 group max | 8% |
| — | ||
| CVE-2020-9552 +1 in the same advisory: …9551 | Adobe Bridge versions 10.0 have a heap-based buffer overflow vulnerability. Adobe Bridge versions 10.0 have a heap-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution. NVD description · AI analysis pending | 7.8 | 6% |
| — |
Full article277 words · extracted from securityaffairs.com · click to collapse
Adobe has released a collection of out-of-band software updates that address a total of 41 vulnerabilities in six of its products.
Adobe has released a set of out-of-band software updates that address a total of 41 vulnerabilities in six of its products.
“Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS.” reads the advisory published by Adobe.
“These updates address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.”
The vulnerabilities affect the following products:
- Genuine Integrity Service
- Acrobat and Reader
- Photoshop
- Experience Manager
- ColdFusion
- Bridge
29 vulnerabilities out of the 41 are rated as critical in severity, the remaining 11 have been rated as important.
Acrobat and Reader software for Windows and macOS systems are affected by 13 vulnerabilities, 9 of these issues (CVE-2020-3795, CVE-2020-3799, CVE-2020-3792, CVE-2020-3793, CVE-2020-3801, CVE-2020-3802, CVE-2020-3805, CVE-2020-3807, CVE-2020-3797) are rated as critical severity.
Genuine Integrity Service is affected by only one important severity privilege escalation flaw tracked as CVE-2020-3766.
Photoshop for Windows and macOS users is affected by a total of 22 vulnerabilities, out of which 16 are critical (CVE-2020-3783, CVE-2020-3784, CVE-2020-3785, CVE-2020-3786, CVE-2020-3787, CVE-2020-3788, CVE-2020-3789, CVE-2020-3790, CVE-2020-3773, CVE-2020-3779, CVE-2020-3770, CVE-2020-3772, CVE-2020-3774, CVE-2020-3775, CVE-2020-3776, CVE-2020-3780).
The company also has addressed one sensitive information disclosure flaw in the Experience Manager application (CVE-2020-3769), two critical issues in the Adobe Bridge digital asset management app (CVE-2020-9551, CVE-2020-9552), and two critical vulnerabilities in the ColdFusion (CVE-2020-3761, CVE-2020-3794).
The good news is that none of the security vulnerabilities addressed by Adobe have been exploited in the wild.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, cybersecurity)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/99910/hacking/adobe-releases-out-of-band-patches.html