Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

DESCRIPTION:
Multiple vulnerabilities have been discovered in Adobe products, the
most severe of which could allow for Arbitrary Code Execution.

* Premiere Rush is a video editor.
* Illustrator is a vector graphics editor and design program.
* Photoshop is a graphics editor.
* Adobe After Effects is a digital visual effects, motion graphics, and
compositing application.
* Creative Cloud is a cloud service provided by Adobe where its software
can be accessed all in one place.

Successful exploitation of the most severe of these vulnerabilities
could allow for arbitrary code execution. Depending on the privileges
associated with the user, an attacker could then install programs; view,
change, or delete data; or create new accounts with full user rights.
Users whose accounts are configured to have fewer user rights on the
system could be less impacted than those who operate with administrative
user rights.

IMPACT:
Multiple vulnerabilities have been discovered in Adobe Products, the
most severe of which could allow for arbitrary code execution. Details
of these vulnerabilities are as follows:

Adobe Premiere Rush
* Out-of-bounds Read, which could allow for Privilege escalation.
(CVE-2022-23204)

Adobe Illustrator
* Out-of-bounds Write which could allow for Arbitrary code execution.
(CVE-2022-23186)
* NULL Pointer Dereference which could allow for Application
denial-of-service (CVE-2022-23189, CVE-2022-23198, CVE-2022-23199)
* Access of Memory Location After End of Buffer which could allow for a
Memory leak (CVE-2022-23190, CVE-2022-23191, CVE-2022-23192,
CVE-2022-23193, CVE-2022-23194, CVE-2022-23195)
* Out-of-bounds Read which could allow for a Memory leak
(CVE-2022-23196, CVE-2022-23197)
* Buffer Overflow which could allow for Arbitrary code execution
(CVE-2022-23188)

Adobe Photoshop
* Buffer Overflow which could allow for Arbitrary code execution.
(CVE-2022-23203)

Adobe After Effects
* Out-of-bounds Write which could allow for Arbitrary code execution.
(CVE-2022-23200)

Adobe Creative Cloud Desktop
* Uncontrolled Search Path Element which could allow for Arbitrary code
execution. (CVE-2022-23202)

Successful exploitation of the most severe of these vulnerabilities
could allow for arbitrary code execution. Depending on the privileges
associated with the user an attacker could then install programs; view,
change, or delete data; or create new accounts with full user rights.
Users whose accounts are configured to have fewer user rights on the
system could be less impacted than those who operate with administrative
user rights.

SYSTEM AFFECTED:
* Adobe Premiere Rush 2.0  and earlier versions for Windows.
* Illustrator 2022 26.0.2 and earlier versions for Windows and macOS.
* Illustrator 2021 25.4.3 and earlier versions for Windows and macOS.
* Photoshop 2021 22.5.4 and earlier versions for Windows and macOS.
* Photoshop 2022 23.1 and earlier versions for Windows and macOS.
* Adobe After Effects 22.1.1 and earlier versions for Windows and macOS.
* Adobe After Effects 18.4.3 and earlier versions for Windows and macOS.
* Creative Cloud Desktop Application (Installer) 2.7.0.13 and earlier
versions for Windows.

RECOMMENDATIONS:
We recommend the following actions be taken:
* Install the updates provided by Adobe immediately after appropriate
testing.
* Run all software as a non-privileged user (one without administrative
privileges) to diminish the effects of a successful attack.
* Remind users not to visit un-trusted websites or follow links provided
by unknown or un-trusted sources.
* Inform and educate users regarding the threats posed by hypertext
links contained in emails or attachments especially from un-trusted sources.
* Apply the Principle of Least Privilege to all systems and services.

REFERENCES:
https://helpx.adobe.com/security/security-bulletin.html
https://helpx.adobe.com/security/products/premiere_rush/apsb22-06.html
https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
https://helpx.adobe.com/security/products/photoshop/apsb22-08.html
https://helpx.adobe.com/security/products/creative-cloud/apsb22-11.html
https://helpx.adobe.com/security/products/after_effects/apsb22-09.html

Published: 09 Feburary 2022, 12:49:00 BST