Adobe’s February 2020 Patch Tuesday updates fix a total of 42 vulnerabilities across the company’s Framemaker, Acrobat and Reader, Flash Player, Digital Editions and Experience Manager products.
The highest number of flaws, 21, has been fixed in the Windows version of the Framemaker document processor. The vulnerabilities have been described as critical buffer overflow, heap overflow, out-of-bounds write, and memory corrupt issues that can lead to arbitrary code execution in the context of the current user.
The security holes were reported to Adobe by a researcher who uses the online moniker “Kdot” through Trend Micro’s Zero Day Initiative.
While the vulnerabilities have been classified as critical, Adobe believes they are unlikely to be exploited in attacks any time soon.
The second highest number of vulnerabilities, 17, was patched by Adobe in the Windows and macOS versions of its Acrobat and Reader products.
The flaws rated critical are memory corruption issues that can be exploited for arbitrary code execution, and privilege escalation issues that can allow an attacker to write arbitrary files to the system. The other vulnerabilities are moderate-severity memory leaks and important-severity information disclosure bugs.
Independent researchers and representatives of Qihoo 360, Tencent, Renmin University of China, Cisco Talos, the Chinese Academy of Sciences, Baidu, and McAfee have been credited for reporting these flaws.
Adobe has also patched two vulnerabilities in Digital Editions, including a critical command injection weakness and an important information disclosure issue.
In Flash Player, the company fixed a serious type confusion that can lead to arbitrary code execution, and in Experience Manager it resolved a denial-of-service (DoS) vulnerability.
Adobe says it’s not aware of any attacks exploiting these vulnerabilities.
Related: Adobe Patches Critical Flaws in Acrobat, Brackets, Photoshop
Related: Two Critical Flaws Patched in Adobe Acrobat, Reader
