Adobe’s February 2020 Patch Tuesday updates fix a total of 42 vulnerabilities across the company’s Framemaker, Acrobat and Reader, Flash Player, Digital Editions and Experience Manager products.
The highest number of flaws, 21, has been fixed in the Windows version of the Framemaker document processor. The vulnerabilities have been described as critical buffer overflow, heap overflow, out-of-bounds write, and memory corrupt issues that can lead to arbitrary code execution in the context of the current user.
The security holes were reported to Adobe by a researcher who uses the online moniker “Kdot” through Trend Micro’s Zero Day Initiative.
While the vulnerabilities have been classified as critical, Adobe believes they are unlikely to be exploited in attacks any time soon.
The second highest number of vulnerabilities, 17, was patched by Adobe in the Windows and macOS versions of its Acrobat and Reader products.
The flaws rated critical are memory corruption issues that can be exploited for arbitrary code execution, and privilege escalation issues that can allow an attacker to write arbitrary files to the system. The other vulnerabilities are moderate-severity memory leaks and important-severity information disclosure bugs.
Independent researchers and representatives of Qihoo 360, Tencent, Renmin University of China, Cisco Talos, the Chinese Academy of Sciences, Baidu, and McAfee have been credited for reporting these flaws.
Adobe has also patched two vulnerabilities in Digital Editions, including a critical command injection weakness and an important information disclosure issue.
In Flash Player, the company fixed a serious type confusion that can lead to arbitrary code execution, and in Experience Manager it resolved a denial-of-service (DoS) vulnerability.
Adobe says it’s not aware of any attacks exploiting these vulnerabilities.
Related: Adobe Patches Critical Flaws in Acrobat, Brackets, Photoshop
Related: Two Critical Flaws Patched in Adobe Acrobat, Reader
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Google Patches Third Chrome Zero-Day of 2023
- ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
Latest News
- Consolidate Vendors and Products for Better Security
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- BBC, British Airways, Novia Scotia Among First Big-Name Victims in Global Supply-Chain Hack
