Pierluigi Paganini February 20, 2020

Adobe released out-of-band security updates for After Effects and Media Encoder applications that address two new critical vulnerabilities.

Adobe released out-of-band security updates for After Effects and Media Encoder applications that fix two new critical vulnerabilities (CVE-2020-3765, CVE-2020-3764).

Adobe After Effects is a digital visual effects, motion graphics, and compositing application developed and used in the post-production process of film making, video games and television production. Adobe Media Encoder is transcoding and compressing app.

The two issued are classified as out-of-bounds write memory corruption flaws, an attacker could exploit them to execute arbitrary code on targeted systems by tricking victims into opening a specially crafted file using the vulnerable software.

The CVE-2020-3765 vulnerability in Adobe After Effects was discovered by security researcher Matt Powell and reported to Adobe via Trend Micro Zero Day Initiative project.

“Adobe has released an update for Adobe After Effects for Windows. This update resolves a critical out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user.” reads the security advisory published by Adobe.

The CVE-2020-3764 flaw in Adobe Media Encoder was reported to Adobe by Canadian security researcher Francis Provencher.

“Adobe has released an update for Adobe Media Encoder. This update resolves  a critical out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. ” reads the advisory published by Adobe.

The good news is that Adobe is not aware of attacks in the wild exploiting one of the two flaws.

Earlier this month, Adobe released February 2020 Patch Tuesday updates that address a total of 42 vulnerabilities in Framemaker, Acrobat and Reader, Flash Player, Digital Editions and Experience Manager products.

Most of the vulnerabilities (21) affect the Windows version of the Framemaker document processor. The most severe issues are classified as critical buffer overflow, heap overflow, out-of-bounds write, and memory corrupt flaws. The vulnerabilities can lead to arbitrary code execution in the context of the current user.

Pierluigi Paganini

(SecurityAffairs – hacking, Adobe)

[adrotate banner=”5″]

[adrotate banner=”13″]