Vulnerabilities

Adobe Fixes Low Priority Flaws With July 2019 Patch Tuesday Updates

Adobe’s Patch Tuesday updates for July 2019 address vulnerabilities in the company’s Bridge CC, Experience Manager and Dreamweaver products, but none of the security holes appear serious.

Eduard Kovacs

July 9, 2019

Adobe’s Patch Tuesday updates for July 2019 address vulnerabilities in the company’s Bridge CC, Experience Manager and Dreamweaver products, but none of the security holes appear serious.

The latest update for Bridge CC on Windows and macOS resolves an out-of-bounds memory read issue that can result in information disclosure in the context of the targeted user. The security hole was reported to Adobe through Trend Micro’s Zero Day Initiative by researcher Francis Provencher.

In Experience Manager, Adobe patched reflected and stored cross-site scripting (XSS) vulnerabilities and a cross-site request forgery (CSRF) bug, all of which, according to the company, can lead to disclosure of sensitive information. Adobe has only credited Lorenzo Pirondini for the reflected XSS.

In Dreamweaver, specifically its direct download installer for Windows, the firm fixed a DLL hijacking issue that can be exploited for privilege escalation. The weakness was reported to Adobe by a bug bounty hunter who uses the online moniker “Honc.”

The vulnerabilities patched on Tuesday have been classified as having either “important” or “moderate” severity and they have been assigned priority ratings of 2 or 3, which means users do not need to urgently install the updates.

Unsurprisingly, Adobe says there is no evidence that any of the flaws have been exploited for malicious purposes.

Some of Adobe’s past Patch Tuesday updates included fixes for over 80 and even over 100 vulnerabilities, but the latest round of patches only resolves five issues. However, in the past, the company also released out-of-band updates to address weaknesses that had been exploited in the wild.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar