Adobe Security Updates – April 2018

Adobe, This Tuesday as always released its security updates April 2018 monthly set of security advisories for vulnerabilities that have been identified and addressed in various products using a vulnerability scanning tool. This month’s advisory release addresses 6 advisories and 19 vulnerabilities , with 6 of them rated critical, 12 are rated important and 1 as moderate in severity. These vulnerabilities impact Adobe PhoneGap Push plugin, ColdFusion, Adobe Digital Editions, Adobe InDesign CC, Adobe Experience Manager and Adobe Flash Player.

The critical patches are for Adobe Flash Player, Adobe InDesign CC and ColdFusion which can be patched using a patch management tool

Adobe Flash has finally touched the Speed Force and is proving to be even faster than The Flash. If you don’t need it, GET RID OF IT! That’s the best advice as far as Adobe Flash can go. ThreadKit, an app for building documents that infect vulnerable PCs with malware when opened, now targets a recently patched Flash security bug. Exploit code samples started showing up in the wild a few days ago. Since the exploit was folded into ThreadKit, examples of fiendish files leverage this latest Flash bug began appearing in antivirus engines. Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current user.

Adobe PhoneGap Push plugin encompasses Same-Origin Method Execution (SOME) vulnerability that exists in PhoneGap apps. However, this vulnerability could be exploited to trick users of PhoneGap apps into executing click events and other unintended user interactions.

ColdFusion, a rapid web application development platform is fused with multiple vulnerabilities that could lead to code injection, information disclosure, unsafe Java deserialization, unsafe XML parsing and insecure library loading. Also, the risks are critical and are advised to be patch immediately.

Adobe InDesign CC, a desktop publishing software infected with a critical memory corruption vulnerability caused by unsafe parsing of a specially crafted .inx file. However, the security flaw, if exploited, can lead to arbitrary code execution, while the slightly less dangerous issue can lead to local privilege escalation. Also, the vulnerability rated as important.

Adobe Experience Manager, an integrated online marketing and web analytics product suffers from cross-site script vulnerabilities which exploited to steal the victim’s cookie-based authentication credentials.

Adobe Digital Editions, an ebook reader software program suffers from an out-of-bounds read vulnerability and then a stack overflow vulnerability kindled by unsafe processing of specially crafted epub files.

Affected products:

• Adobe PhoneGap Push plugin
• ColdFusion
• Adobe Digital Editions
• Adobe InDesign CC
• Adobe Experience Manager
• Adobe Flash Player

Adobe Security Bulletin summary for April 2018:

1. Product : Adobe PhoneGap Push pluginCVE’s/Advisory : APSB18-15, CVE-2018-4943Severity :  ImportantImpact : JavaScript code execution in the context of the PhoneGap app

2. Product : ColdFusionCVE’s/Advisory : APSB18-14, CVE-2018-4938, CVE-2018-4939, CVE-2018-4940, CVE-2018-4941 and then CVE-2018-4942Severity : CriticalImpact : Local privilege escalation, Remote code execution, Information Disclosure

3. Product : Adobe Digital EditionsCVE’s/Advisory : APSB18-13, CVE-2018-4925 and then CVE-2018-4926Severity : ImportantImpact : Information Disclosure

4. Product : Adobe InDesign CCCVE’s/Advisory : APSB18-11, CVE-2018-4927 and then CVE-2018-4928Severity : CriticalImpact : Local Privilege Escalation, Arbitrary Code Execution

5. Product : Adobe Experience ManagerCVE’s/Advisory : APSB18-10, CVE-2018-4929, CVE-2018-4930 and then CVE-2018-4931Severity : ImportantImpact : Sensitive Information disclosure

6. Product : Adobe Flash PlayerCVE’s/Advisory : APSB18-08, CVE-2018-4932, CVE-2018-4933, CVE-2018-4934, CVE-2018-4935, CVE-2018-4936 and then CVE-2018-4937Severity : CriticalImpact : Information Disclosure, Remote Code Execution

Also, SecPod Saner detects these vulnerabilities and automatically fixes it by applying security updates. Moreover, download Saner now and keep your systems updated and secure.