Adobe’s Patch Tuesday security updates for January 2019 fix two “important” vulnerabilities in the Connect and Digital Editions ebook reader products.
The first flaw, tracked as CVE-2018-19718, is a session token exposure issue that affects the Adobe Connect web conferencing software. The vulnerability could lead to the exposure of privileges granted to a session, it affects Adobe Connect version 9.8.1 and earlier for all platforms.
The second flaw, tracked as CVE-2018-12817, is an out-of-bounds read bug that affects the Digital Editions ebook reader software. The flaw can result in the disclosure of information in the context of the current user, it affects Adobe Digital Editions version 4.5.9 and earlier on Windows, macOS, iOS and Android platforms. The vulnerability was reported by Jaanus Kääp of Clarified Security.
The good news is that Adobe is not aware of cyber attacks in the wild exploiting the two flaws, experts believe that the likelihood of their exploitation is very low. Both flaws were rated as important and received a priority rating of 3.
On January 3, Adobe released security updates that address two critical vulnerabilities in the Acrobat and Reader products, a use-after-free issue and a security bypass flaw.
The flaws affect the latest versions of Acrobat DC, Acrobat Reader DC, Acrobat 2017 and Acrobat Reader DC 2017 for Windows and macOS.
(SecurityAffairs – Adobe, Connect)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.