Adobe Security Updates November 2019

Adobe has released security updates as a part of its monthly cycle Adobe Security Updates November 2019. There are a total of 11 vulnerabilities in four products. Three CVEs rated critical and eight CVEs rated important using a vulnerability scanning tool. An overall priority rating of 3 assigned to all the advisories. According to Adobe’s metrics, Priority 3 would mean “This update resolves vulnerabilities in a product that has historically not been a target for attackers. Also, Adobe recommends administrators install the update at their discretion”.

However, the products which received the updates this month are Adobe Animate CC, Adobe Illustrator CC, Adobe Media Encoder and Adobe Bridge CC. Auto patching is very important here.

Two critical vulnerabilities were resolved in Adobe Illustrator CC. CVE-2019-8247 and CVE-2019-8248 are the two memory corruption vulnerabilities which allow an attacker to execute arbitrary code. Another Insecure Library Loading (DLL hijacking) vulnerability(CVE-2019-7962) was fixed in Adobe Illustrator CC which leads to privilege escalation.

Five vulnerabilities were resolved in Adobe Media Encoder, one of which is rated critical. CVE-2019-8246 is an ‘Out-of-bounds Write’ vulnerability which allows an attacker to execute arbitrary code on the target machine. Also, Four other important vulnerabilities are classified as ‘Out-of-bounds Read’ and lead to information disclosure.

Two important vulnerabilities were fixed in Adobe Bridge CC. These are memory corruption vulnerabilities that occur when parsing malformed SVG images. Exploitation of these flaws leads to information disclosure in the context of current user.

One important Insecure Library Loading (DLL hijacking) vulnerability in Adobe Animate CC a fix. However, an attacker can exploit this vulnerability to gain elevated privileges on the machine.

1. Product : Adobe Animate CCCVE’s/Advisory : APSB19-34, CVE-2019-7960Severity : ImportantImpact : Privilege Escalation

2. Product : Adobe Illustrator CCCVE’s/Advisory : APSB19-36, CVE-2019-7962, CVE-2019-8247 and then CVE-2019-8248Severity : CriticalImpact : Privilege Escalation, Arbitrary Code Execution

3. Product : Adobe Media EncoderCVE’s/Advisory : APSB19-52, CVE-2019-8241, CVE-2019-8242, CVE-2019-8243, CVE-2019-8244 and then CVE-2019-8246Severity : CriticalImpact : Arbitrary Code Execution, Information Disclosure

4. Product : Adobe Bridge CCCVE’s/Advisory : APSB19-53, CVE-2019-8239 and then CVE-2019-8240Severity : ImportantImpact : Information Disclosure

SecPod Saner detects these vulnerabilities and automatically fixes it by applying security updates. Download Saner now and keep your systems updated and secure.