Adobe Patches 18 Critical Code Execution Flaws Across Five Products

Adobe addressed 18 critical code execution flaws in After Effects, Illustrator, Premiere Pro, Premiere Rush, and Audition products.

Adobe addressed 18 critical code execution vulnerabilities in its After Effects, Illustrator, Premiere Pro, Premiere Rush, and Audition products.

The IT giant patched five critical out-of-bounds write (CVE-2020-9660, CVE-2020-9662), out-of-bounds read (CVE-2020-9661) and heap overflow (CVE-2020-9637, CVE-2020-9638) vulnerabilities in After Effects that can be exploited by attackers to execute arbitrary code in the context of the targeted user.

The company also addressed five buffer errors (CVE-2020-9642) and memory corruption issues (CVE-2020-9575, CVE-2020-9641, CVE-2020-9640, CVE-2020-9639) in Illustrator that led to critical code execution vulnerabilities.

Adobe also fixed 3hree out-of-bounds read (CVE-2020-9652) and out-of-bounds write (CVE-2020-9653, CVE-2020-9654) issues in the Windows and macOS versions of the Premiere Pro video editing software that can lead to code execution.

Adobe also addressed three out-of-bounds read (CVE-2020-9655) and out-of-bounds write (CVE-2020-9656, CVE-2020-9657) issues in the Windows and macOS versions of Premiere Rush.

The remaining issues (CVE-2020-9658, CVE-2020-9659) were addressed in Audition audio recording and editing software.

The above vulnerabilities were reported to Adobe by researchers from Fortinet and Trend Micro’s Zero Day Initiative (ZDI).

The good news is that the company is not aware of any attacks exploiting these vulnerabilities in the wild.

Early this month, Adobe has released security updates to address vulnerabilities in its Flash Player, Framemaker and Experience Manager products.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, security)

[adrotate banner=”5″]

[adrotate banner=”13″]