Adobe addresses two critical vulnerabilities in Photoshop
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21070 | Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with admin permissions to write to the file system could leverage this vulnerability to escalate privileges. NVD description · AI analysis pending | 6.5 | 2% |
| — | ||
| CVE-2021-21092 | Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by a memory corruption vulnerability when parsing a specially crafted file. Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. NVD description · AI analysis pending | 7.8 group max | 4% |
| — | ||
| CVE-2021-21100 | Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during installation. Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during installation. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary file system write in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. NVD description · AI analysis pending | 7.8 | 2% |
| — | ||
| CVE-2021-28549 +1 in the same advisory: …28548 | Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted JSX file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. NVD description · AI analysis pending | 7.8 | 7% |
| — |
Full article266 words · extracted from securityaffairs.com · click to collapse
Adobe has addressed security vulnerabilities in Adobe Photoshop, Adobe Digital Editions, Adobe Bridge, and RoboHelp.
Adobe has fixed ten security vulnerabilities in Adobe Photoshop, Adobe Digital Editions, Adobe Bridge, and RoboHelp.
Seven vulnerabilities have been rated as critical, some of them could be exploited by remote attackers to execute arbitrary code.
Adobe has released two buffer overflow issues, tracked CVE-2021-28548 and CVE-2021-28549, that could lead to arbitrary code execution. Both issues were reported by guoxi of venustech ADLab. Affected Versions are:
| Product | Affected version | Platform |
|---|---|---|
| Photoshop 2020 | 21.2.6 and earlier versions | Windows and macOS |
| Photoshop 2021 | 22.3 and earlier versions | Windows and macOS |
The tech giant also addressed four ‘Critical’ code execution flaws and two vulnerabilities rated as ‘Important’ in the Adobe Bridge.
In the following table are reported vulnerability details:
| Vulnerability Category | Vulnerability Impact | Severity | CVE Numbers |
| Out-of-bounds read | Information Disclosure | Important | CVE-2021-21091 |
| Improper Authorization | Privilege Escalation | Important | CVE-2021-21096 |
| Memory Corruption | Arbitrary code execution | Critical | CVE-2021-21093CVE-2021-21092 |
| Out-of-bounds write | Arbitrary code execution | Critical | CVE-2021-21094CVE-2021-21095 |
The issues were reported by Francis Provencher from Trend Micro Zero Day Initiative (CVE-2021-21091, CVE-2021-21092, CVE-2021-21093, CVE-2021-21094), Tran Van Khang – khangkito (VinCSS) CVE-2021-21095), and ikth working with Trend Micro Zero Day Initiative (CVE-2021-21096).
Adobe also fixed a critical Privilege Escalation vulnerability in Adobe Digital Editions for macOS, tracked as CVE-2021-21100, and an Important Privilege Escalation vulnerability in RoboHelp, tracked as CVE-2021-21070.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Photoshop)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/116760/security/adobe-critical-flaws-photoshop.html