Pierluigi Paganini May 15, 2018

On Monday, Adobe issued security updates for 47 vulnerabilities in the Windows and macOS versions of Acrobat DC (Consumer and Classic 2015), Acrobat Reader DC (Consumer and Classic 2015), Acrobat 2017, and Acrobat Reader 2017.

Many vulnerabilities are ranked as critical and could be exploited for arbitrary code execution.

“Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS. These updates address critical vulnerabilities whose successful exploitation could lead to arbitrary code execution in the context of the current user.” reads the security advisory published by Adobe.

Many of the security vulnerabilities were reported to Adobe through Trend Micro’s Zero Day Initiative (ZDI).

Adobe addressed the vulnerabilities with the release of versions 2018.011.20040, 2017.011.30080 and 2015.006.30418.

The vulnerabilities include 24 critical memory corruptions that could be exploited to execute arbitrary in the context of the targeted user and many other issues  such as Security Bypass and NTLM SSO hash theft ranked as “important.”

Adobe has credited independent researchers and experts from Cisco Talos, Check Point, Palo Alto Networks, Tencent, Knownsec 404 Security Team, ESET, Kaspersky, Cybellum, and Cure53 for the vulnerabilities in Acrobat and Reader releases.

Adobe announced the end of support for Acrobat and Reader 11.x on October 15, 2017, and that version 11.0.23 is the final release for these products.

Adobe has also released security updates to fix a flaw in the Windows and macOS versions of Photoshop CC.

“Adobe has released updates for Photoshop CC for Windows and macOS. These updates resolve a criticalvulnerability in Photoshop CC 19.1.3 and earlier 19.x versions, as well as 18.1.3 and earlier 18.x versions. Successful exploitation could lead to arbitrary code execution in the context of the current user.” reads the security advisory.

A few days ago, Adobe has released security updates to address several vulnerabilities in its products, including Flash Player, Creative Cloud and Connect products.

The security updates also address a Critical Code Execution vulnerability in Flash Player tracked as CVE-2018-4944. The flaw is a critical type confusion that could be exploited to execute arbitrary code, the good news is that Adobe has rated the flaw with a rating of “2” because the company considers not imminent the development of exploit code.

Pierluigi Paganini

(Security Affairs – Adobe, cyber security)

[adrotate banner=”5″]

[adrotate banner=”13″]