Adobe on Tuesday announced the availability of patches for a total of 80 vulnerabilities across the company’s Flash Player, Photoshop, Connect, Acrobat and Reader, DNG Converter, InDesign, Digital Editions, Shockwave Player, and Experience Manager products.
The highest number of vulnerabilities, 56, has been addressed in Acrobat and Reader for Windows and Mac. The list includes many critical uninitialized pointer access, use-after-free, buffer access, buffer over-read, buffer overflow, out-of-bounds read/write, improper array index validation, security bypass, type confusion, and untrusted pointer dereference issues that can be exploited for remote code execution.
A total of 16 companies and individuals have been credited for reporting the Acrobat and Reader security holes. Well over half of the flaws were discovered by employees of China-based Tencent.
Updates for the Windows, Mac, Linux and Chrome OS versions of Flash Player patch five critical out-of-bounds read and use-after-free vulnerabilities that can be exploited for remote code execution.
Critical code execution weaknesses have also been resolved in the Windows and Mac versions of Photoshop CC, and Shockwave Player for Windows.
In Adobe Connect, the company fixed four server-side request forgery (SSRF) and cross-site scripting (XSS) issues, and added a feature designed to help administrators protect users against clickjacking attacks.
In Digital Editions for Windows, Mac, iOS, and Android, Adobe addressed six bugs that can lead to disclosure of memory addresses and other information.
Adobe also advised users to update Experience Manager in order to address moderate and important severity XSS and information disclosure vulnerabilities. One critical memory corruption flaw was patched in DNG Converter for Windows, and one similar issue was resolved in InDesign for Windows and Mac.
Adobe says there is no evidence that any of these flaws have been exploited in the wild. On last month’s Patch Tuesday, Adobe announced that there had not been any security updates. However, the company was forced to release an out-of-band update just a few days later after learning of a Flash Player zero-day that had been exploited by a Middle Eastern threat actor to deliver spyware.
Microsoft has also released its Patch Tuesday updates. The company addressed more than 50 vulnerabilities, including 20 critical browser flaws.
Related: Adobe Accidentally Posts Private PGP Key
Related: Adobe Patches Two Critical Flaws in Flash Player
Related: Adobe Patches 69 Flaws in Reader, Acrobat
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Government Shutdown Could Bench 80% of CISA Staff
- Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
- macOS 14 Sonoma Patches 60 Vulnerabilities
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
- Microsoft Adding New Security Features to Windows 11
- Sony Investigating After Hackers Offer to Sell Stolen Data
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
Latest News
- Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Lumu Raises $30 Million for Threat Detection and Response Platform
- Government Shutdown Could Bench 80% of CISA Staff
- Moving From Qualitative to Quantitative Cyber Risk Modeling
- Cisco Warns of IOS Software Zero-Day Exploitation Attempts
- Russian Zero-Day Acquisition Firm Offers $20 Million for Android, iOS Exploits
- Sysdig Launches Realtime Attack Graph for Cloud Environments
