Adobe has released a patch update that addresses vulnerabilities in four products, including out-of-bounds issues and memory corruptions that lead to arbitrary code execution.
The software involved in this round of security updates is Adobe Media Encoder, Illustrator CC, Adobe Bridge CC, and Adobe Animate CC.
Adobe lists Media Encoder as the primary recipient of security fixes.
The video optimization software, version 14.0, 13.1 and earlier on Windows and macOS, has been patched to fix five bugs. While all of the vulnerabilities are caused by file parsing issues – four out-of-bounds read issues are considered significant (CVE-2019-8241, CVE-2019-8242, CVE-2019-8243 and CVE-2019-8244) as they could cause information leaks, while CVE-2019-8246, a critical out-of-bounds write vulnerability could allow attackers to execute arbitrary code.
For Illustrator CC, version 23.1 and later and v.24.0 for Windows and macOS, two critical bugs and one important bug have been fixed. The less important bug, CVE-2019-7962, is a privilege escalation, while the other two issues – CVE-2019-8247 and CVE-2019-8248 – are critical memory corruptions that can be exploited for code execution.
Adobe has also released a security update for Adobe Bridge CC. Affecting Windows and macOS, as well as versions 10, 9.1 and earlier, the two vulnerabilities – CVE-2019-8239 and CVE-2019-8240 – can be exploited when the software attempts to parse malformed SVG images, requesting the ability to disclose information.
Additionally, Adobe has released a software update for Adobe Animate CC 19.2.1 and earlier versions on Windows and Animate CC version 20 on Windows and macOS.
This update addresses CVE-2019-7960, a serious DLL that can lead to privilege escalation.
The giant thanked the security researchers for finding and reporting the vulnerabilities.
