Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cloud Security

Adobe Patches Code Execution Flaws in Connect, Creative Cloud, Framemaker

Adobe on Tuesday announced that it has patched critical code execution vulnerabilities in its Connect, Creative Cloud, and Framemaker products.

Adobe on Tuesday announced that it has patched critical code execution vulnerabilities in its Connect, Creative Cloud, and Framemaker products.

In the Creative Cloud desktop application, Adobe fixed three flaws rated critical, including arbitrary file overwrite and OS command injection issues that can lead to code execution, and an improper input validation issue that can be exploited for privilege escalation.

In its Connect product, the company addressed one critical input validation issue that can result in arbitrary code execution and three important-severity reflected cross-site scripting (XSS) flaws that can allow an attacker to execute arbitrary JavaScript code in the targeted user’s browser. XSS attacks typically require the victim to click on a specially crafted link.

In Framemaker, Adobe patched one critical out-of-bounds read vulnerability that can lead to code execution.

Adobe said it had found no evidence of exploitation for malicious purposes, and since all vulnerabilities have been assigned a priority rating of 3, the company likely does not expect them to ever be exploited in attacks.

The software giant has credited independent security researchers for most of the vulnerabilities fixed with these Patch Tuesday updates.

Adobe last month patched a Reader vulnerability that had been exploited in the wild, but no information has been made available on those attacks.

Related: Hackers Target Two Unpatched Flaws in Windows Adobe Type Manager Library

Related: Adobe Patches 14 Vulnerabilities in Acrobat Products

Related: Weak ACLs in Adobe ColdFusion Allow Privilege Escalation

Related: Unofficial Patch Released for Adobe Reader Zero-Day

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.