Adobe addresses over 60 vulnerabilities in multiple products

Adobe warns of threat actors that could exploit critical vulnerabilities in multiple products running on Windows and macOS systems.

Adobe has issued critical warnings for more than 60 vulnerabilities in multiple products running on Windows and macOS machines.

The vulnerabilities can be exploited by threat actors for code execution, privilege escalation and denial-of-service attacks.

The company said it was not aware of in-the-wild exploitation of any of the documented vulnerabilities.

Adobe has addressed three  critical  and important vulnerabilities in Photoshop for Windows and macOS. An attacker could trigger these flaws for arbitrary code execution and memory leak in the context of the current user.   

Below are the vulnerability details:

Vulnerability Category	Vulnerability Impact	Severity	CVSS base score	CVSS vector	CVE Number
Out-of-bounds Write (CWE-787)	Arbitrary code execution	Critical	7.8	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2021-43018
Access of Memory Location After End of Buffer (CWE-788)	Memory Leak	Important	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CVE-2021-43020
Buffer Overflow (CWE-120)	Arbitrary code execution	Critical	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2021-44184

CVE-2021-43018 has been reported by Mat Powell working with Trend Micro Zero Day Initiative, while CVE-2021-43020 and CVE-2021-44184 have been reported by Kushal Arvind Shah of Fortinet’s FortiGuard Labs.

Adobe also fixed multiple code execution vulnerabilities in the Adobe Experience Manager:

Vulnerability Category	Vulnerability Impact	Severity	CVSS base score	CVSS vector	CVE Number
Cross-site Scripting (XSS)(CWE-79)	Arbitrary code execution	Critical	8.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	CVE-2021-43761
Improper Restriction of XML External Entity Reference (‘XXE’) (CWE-611)	Arbitrary code execution	Critical	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CVE-2021-40722
Improper Input Validation (CWE-20)	Security feature bypass	Important	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	CVE-2021-43762
Cross-site Scripting (XSS)(CWE-79)	Arbitrary code execution	Critical	8.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	CVE-2021-43764
Cross-site Scripting (Stored XSS) (CWE-79)	Arbitrary code execution	Critical	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	CVE-2021-43765
Cross-site Scripting (Stored XSS) (CWE-79)	Arbitrary code execution	Critical	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	CVE-2021-44176
Cross-site Scripting (Stored XSS) (CWE-79)	Arbitrary code execution	Critical	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	CVE-2021-44177
Cross-site Scripting (Reflected XSS) (CWE-79)	Arbitrary code execution	Important	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	CVE-2021-44178

The good news is that Adobe’s Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploring these vulnerabilities.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Adobe)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.