Coming Soon...

Q-CERT website is currently under maintenance. We should be back shortly. Thank you for yor patience.

Arbitrary Code Execution in various Adobe CC products

Issued: 
Tuesday, 20 September, 2022
Last Revision: 
Tuesday, 20 September, 2022
Vendor: 
Severity Level: 
Summary: 

Adobe has rolled out numerous security fixes and updates addressing more than 60 exploitable vulnerabilities in its products line, specifically, the Creative Cloud bundle. The roll out has targeted the following products: Bridge, InDesign, Photoshop, InCopy, Animate, and Illustrator.

 

Attacker can exploit vulnerabilities in the affected versions of these products through arbitrary code execution and memory leakages in the both leading operating systems, Windows and MacOS. This threat has direct impact to confidentiality, and to some degree, availability and integrity as well. 

 

 

CVE/Vulnerability

Description 

CVSS3.0 Score

multiple (check the affected products below)

Arbitrary Code execution 

7.8

 

 

Table 1: Vulnerability details 

 

 

CVE/Vulnerability

Affected Product(s)

Affected Versions

CVE-2022-35700 → CVE-2022-35709

Adobe Bridge

12.0.2 and earlier

11.1.3 and earlier

CVE-2022-28851 → CVE-2022-28857, and CVE-2022-38414 → CVE-2022-38417

Adobe InDesign

17.3 and earlier

16.4.2 and earlier

CVE-2022-38426 → CVE-2022-38434, and CVE-2022-38413

Adobe Photoshop

22.5.8 and earlier

23.4.2 and earlier

CVE-2022-38401 → CVE-2022-38407

Adobe InCopy

17.3 and earlier

16.4.2 and earlier

CVE-2022-38411

Adobe Animate

21.0.11 and earlier

CVE-2022-38412

22.0.7 and earlier

CVE-2022-38408

Adobe Illustrator

26.4 and earlier

25.4.7 and earlier

                

                                                                                        Table 2: Vulnerable versions 

Recommendation: 

Apply the following updates either via Creative Cloud platform or from Adobe website:

 

Product

Version

 

Adobe Bridge

12.0.3 

 

11.1.4 

 

Adobe InDesign

17.4 

 

16.4.3 

 

Adobe Photoshop

22.5.9 

 

23.5 

 

Adobe InCopy

17.4 

 

16.4.3 

 

Adobe Animate

21.0.12 

 

22.0.8 

 

Adobe Illustrator

26.5 

 

25.4.8