Skip to content
OpenAdvisories
High NCSC-2024-0368 27 CVEs

Kwetsbaarheden verholpen in Adobe producten

Published Sep 11, 2024 · Updated Sep 11, 2024 · nl

Vendor: Adobe Product: Acrobat 2024 Product: Acrobat DC Product: Acrobat Reader DC Product: acrobat_2020 Product: acrobat_reader_2020 Product: Adobe After Effects Product: Adobe Audition Product: Adobe Media Encoder Product: Adobe Premiere Pro Product: After Effects Product: Audition Product: ColdFusion 2023 Product: coldfusion_2021 Product: Illustrator Product: illustrator_2023 Product: illustrator_2024 Product: Photoshop Product: photoshop_2023 Product: photoshop_2024 Product: Premiere Pro

Summary

Er zijn kwetsbaarheden verholpen in Adobe producten.

Details

Interpretaties
De kwetsbaarheden stellen een kwaadwillende in staat aanvallen uit te voeren die leiden tot de volgende categorieën schade:

- Denial-of-Service (DoS)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 27

  • Critical 9.8
    CVE-2024-41874 EPSS 30%

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing craft…

    Adobe ColdFusion
  • High 7.8
    CVE-2024-34121

    Illustrator | Integer Overflow or Wraparound (CWE-190)

    Illustrator versions 28.6, 27.9.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vict…

    Adobe Illustrator
  • High 7.8
    CVE-2024-39377

    Media Encoder | Out-of-bounds Write (CWE-787)

    Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must o…

    Adobe Media Encoder
  • High 7.8
    CVE-2024-39378

    Audition | Out-of-bounds Write (CWE-787)

    Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…

    Adobe Audition
  • High 7.8
    CVE-2024-39380

    After Effects | Heap-based Buffer Overflow (CWE-122)

    After Effects versions 23.6.6, 24.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim …

    Adobe After Effects
  • High 7.8
    CVE-2024-39381

    After Effects | Out-of-bounds Write (CWE-787)

    After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must o…

    Adobe After Effects
  • High 7.8
    CVE-2024-39384

    Premiere Pro | Out-of-bounds Write (CWE-787)

    Premiere Pro versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must op…

    Adobe Premiere Pro
  • High 7.8
    CVE-2024-41856

    Illustrator | Improper Input Validation (CWE-20)

    Illustrator versions 28.5, 27.9.4, 28.6, 27.9.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in th…

    Adobe Illustrator
  • High 7.8
    CVE-2024-41857

    Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191)

    Illustrator versions 28.6, 27.9.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in tha…

    Adobe Illustrator
  • High 7.8
    CVE-2024-41859

    After Effects | Out-of-bounds Write (CWE-787)

    After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must o…

    Adobe After Effects
  • High 7.8
    CVE-2024-41869

    Acrobat Reader | Use After Free (CWE-416)

    Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires use…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-43756

    Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)

    Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vi…

    Adobe Photoshop Desktop
  • High 7.8
    CVE-2024-43758

    Illustrator | Use After Free (CWE-416)

    Illustrator versions 28.6, 27.9.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma…

    Adobe Illustrator
  • High 7.8
    CVE-2024-43760

    Photoshop Desktop | Out-of-bounds Write (CWE-787)

    Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim m…

    Adobe Photoshop Desktop
  • High 7.8
    CVE-2024-45108

    Photoshop Desktop | Out-of-bounds Write (CWE-787)

    Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim m…

    Adobe Photoshop Desktop
  • High 7.8
    CVE-2024-45109

    Photoshop Desktop | Out-of-bounds Write (CWE-787)

    Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim m…

    Adobe Photoshop Desktop
  • High 7.8
    CVE-2024-45112

    Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)

    Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when a resource is ac…

    Adobe Acrobat Reader
  • Medium 5.5
    CVE-2024-39382

    After Effects | Out-of-bounds Read (CWE-125)

    After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue…

    Adobe After Effects
  • Medium 5.5
    CVE-2024-39385

    Premiere Pro | Use After Free (CWE-416)

    Premiere Pro versions 24.5, 23.6.8 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requi…

    Adobe Premiere Pro
  • Medium 5.5
    CVE-2024-41867

    After Effects | Out-of-bounds Read (CWE-125)

    After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue…

    Adobe After Effects
  • Medium 5.5
    CVE-2024-41868

    Audition | Out-of-bounds Read (CWE-125)

    Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue re…

    Adobe Audition
  • Medium 5.5
    CVE-2024-41870

    Media Encoder | Out-of-bounds Read (CWE-125)

    Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue…

    Adobe Media Encoder
  • Medium 5.5
    CVE-2024-41871

    Media Encoder | Out-of-bounds Read (CWE-125)

    Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue…

    Adobe Media Encoder
  • Medium 5.5
    CVE-2024-41872

    Media Encoder | Out-of-bounds Read (CWE-125)

    Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue…

    Adobe Media Encoder
  • Medium 5.5
    CVE-2024-41873

    Media Encoder | Out-of-bounds Read (CWE-125)

    Media Encoder versions 24.5, 23.6.8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue…

    Adobe Media Encoder
  • Medium 5.5
    CVE-2024-43759

    Illustrator | NULL Pointer Dereference (CWE-476)

    Illustrator versions 28.6, 27.9.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a DoS conditi…

    Adobe Illustrator
  • Medium 5.5
    CVE-2024-45111

    Illustrator | Out-of-bounds Read (CWE-125)

    Illustrator versions 28.6, 27.9.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue r…

    Adobe Illustrator

Revision history

  1. #0

    Initiele versie

References

  • Source - adobe
    https://helpx.adobe.com/security/products/acrobat/apsb24-70.html
  • Source - adobe
    https://helpx.adobe.com/security/products/after_effects/apsb24-55.html
  • Source - adobe
    https://helpx.adobe.com/security/products/illustrator/apsb24-66.html
  • Source - adobe
    https://helpx.adobe.com/security/products/premiere_pro/apsb24-58.html
  • Source - adobe
    https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
  • Source - adobe
    https://helpx.adobe.com/security/products/coldfusion/apsb24-71.html