Pierluigi Paganini January 09, 2019

Adobe’s Patch Tuesday security updates for January 2019 fix two flaws rated as “important” in the Connect and Digital Editions products.

Adobe’s Patch Tuesday security updates for January 2019 fix two “important” vulnerabilities in the Connect and Digital Editions ebook reader products.

The first flaw, tracked as CVE-2018-19718, is a session token exposure issue that affects the Adobe Connect web conferencing software. The vulnerability could lead to the exposure of privileges granted to a session, it affects Adobe Connect version 9.8.1 and earlier for all platforms.

The second flaw, tracked as CVE-2018-12817, is an out-of-bounds read bug that affects the Digital Editions ebook reader software. The flaw can result in the disclosure of information in the context of the current user, it affects Adobe Digital Editions version 4.5.9 and earlier on Windows, macOS, iOS and Android platforms. The vulnerability was reported by Jaanus Kääp of Clarified Security.

The good news is that Adobe is not aware of cyber attacks in the wild exploiting the two flaws, experts believe that the likelihood of their exploitation is very low. Both flaws were rated as important and received a priority rating of 3.

On January 3, Adobe released security updates that address two critical vulnerabilities in the Acrobat and Reader products, a use-after-free issue and a security bypass flaw.

The flaws affect the latest versions of Acrobat DC, Acrobat Reader DC, Acrobat 2017 and Acrobat Reader DC 2017 for Windows and macOS.

Pierluigi Paganini

(SecurityAffairs – Adobe, Connect)

[adrotate banner=”5″] [adrotate banner=”13″]