Adobe releases a new set of out-of-band patches for its products

Pierluigi Paganini October 21, 2020

Adobe has released a second out-of-band security update to address critical vulnerabilities affecting several products. 

Adobe has released a second out-of-band security update to fix critical vulnerabilities that impact numerous products of the IT giant. 

The flaws impact Adobe Illustrator, Dreamweaver, Marketo, Animate, After Effects, Photoshop, Premiere Pro, Media Encoder, InDesign, and the Creative Cloud desktop application on Windows and macOS machines. 

Adobe has released seven critical vulnerabilities in Illustrator, including memory corruption and out of bounds read/write issues that can lead to arbitrary code execution. 

Below the vulnerability details:

Vulnerability CategoryVulnerability ImpactSeverityCVE Numbers
Out-of-Bounds Read


Arbitrary code execution  CriticalCVE-2020-24409
CVE-2020-24410
Out-of-Bounds WriteArbitrary code execution 


Critical


CVE-2020-24411
Memory Corruption    Arbitrary Code Execution    Critical CVE-2020-24412
CVE-2020-24413
CVE-2020-24414
CVE-2020-24415

Adobe has addressed an “important” uncontrolled search path element security flaw in Dreamweaver which could be exploited by attackers to escalate privilege.

Vulnerability CategoryVulnerability ImpactSeverityCVE Numbers
Uncontrolled Search Path Element
Privilege Escalation ImportantCVE-2020-24425

The company fixed four critical vulnerabilities in Animate, they are out-of-bounds read, stack overflow, and double-free flaws that can result in arbitrary code execution.  

Vulnerability CategoryVulnerability ImpactSeverityCVE Numbers
Double-freeArbitrary code executionCriticalCVE-2020-9747
Stack-based buffer overflowArbitrary code executionCriticalCVE-2020-9748
Out-of-bounds readArbitrary code executionCriticalCVE-2020-9749
CVE-2020-9750

Adobe addressed an “important” XSS issue impacting the Marketo Sales Insight Salesforce package that could have been weaponized to deploy malicious JavaScript in a browser session. 

 Vulnerability Category Vulnerability ImpactSeverityCVE numbers
Cross-site Scripting (stored) JavaScript execution in the browserImportantCVE-2020-24416

The company addressed

Vulnerability details

Vulnerability CategoryVulnerability ImpactSeverityCVE Numbers
Out-of-Bounds Read Arbitrary Code Execution     Critical  CVE-2020-24418
Uncontrolled search pathArbitrary Code Execution       CriticalCVE-2020-24419

Adobe addressed a single out-of-bounds read and an uncontrolled search path critial flaws in After Effects that could lead to the execution of malicious code are now patched. 

Vulnerability CategoryVulnerability ImpactSeverityCVE Numbers
Out-of-Bounds Read Arbitrary Code Execution     Critical  CVE-2020-24418
Uncontrolled search pathArbitrary Code Execution       CriticalCVE-2020-24419

Adobe has fixed a critical memory corruption flaw in InDesign that could also be exploited to execute arbitrary code. 

Vulnerability CategoryVulnerability ImpactSeverityCVE Number
Memory Corruption Arbitrary Code ExecutionCriticalCVE-2020-24421

The company also fixed other critical uncontrolled search path issues in PhotoshopPremiere ProMedia Encoder, and Creative Cloud installer for desktop.

Last week, Adobe released a separate set of out-of-band security patches affecting the Magento platform.

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, code execution)

[adrotate banner=”5″]

[adrotate banner=”13″]



you might also like

leave a comment