Adobe Patches 123 Vulnerabilities Across 11 Products
Summary
Adobe fixed 123 vulnerabilities across 11 products, including critical code-execution flaws in Campaign Classic and ColdFusion. Adobe says it is unaware of in-the-wild exploitation; only those two products received priority rating 1.
Key points
- Adobe patched 123 vulnerabilities across 11 products.
- Experience Manager accounted for 57 fixes, mostly for XSS flaws that allow arbitrary code execution.
- Campaign Classic received patches for two critical arbitrary-code-execution flaws, both with CVSS scores of 10.
- ColdFusion fixes address seven vulnerabilities, including critical and high-severity flaws that could enable code execution, privilege escalation, or security-feature bypass.
- Acrobat and Reader for Windows and macOS received 20 fixes, including for code execution, denial of service, and memory exposure.
- Adobe says it is unaware of in-the-wild exploitation; most flaws have priority rating 3, while ColdFusion and Campaign Classic flaws have rating 1.
Article Details
- Event Type
- Adobe Patch Tuesday security updates
- Impact
- Adobe patched 123 vulnerabilities across 11 products. Reported impacts include arbitrary code execution, privilege escalation, security-feature bypass, denial of service, and memory exposure. Adobe said it was unaware of in-the-wild exploitation of these vulnerabilities. Most received priority rating 3; ColdFusion and Campaign Classic vulnerabilities received priority rating 1.
Vendors
Products
Adobe AcrobatTwenty security holes have been fixed in Acrobat and Reader for Windows and macOS, including code execution, DoS, and memory exposure bugs.Adobe Acrobat ReaderTwenty security holes have been fixed in Acrobat and Reader for Windows and macOS, including code execution, DoS, and memory exposure bugs.Adobe Campaign ClassicTwo critical issues with a CVSS score of 10, both allowing arbitrary code execution, have been patched in Adobe Campaign Classic.Adobe ColdFusionIn ColdFusion, Adobe resolved seven vulnerabilities, including critical and high-severity issues that could allow arbitrary code execution, privilege escalation, and bypass of security features.Adobe Experience ManagerOf the total, 57 vulnerabilities were patched in Adobe Experience Manager.Adobe Experience Manager FormsCritical and high-severity code execution vulnerabilities have been patched by Adobe in Dreamweaver, Format Plugins, Experience Manager Forms, InDesign, InCopy, and Substance 3D Sampler.Adobe InDesignCritical and high-severity code execution vulnerabilities have been patched by Adobe in Dreamweaver, Format Plugins, Experience Manager Forms, InDesign, InCopy, and Substance 3D Sampler.Content Credentials SDKAdobe also addressed several DoS flaws in the Content Credentials SDK.DreamweaverCritical and high-severity code execution vulnerabilities have been patched by Adobe in Dreamweaver, Format Plugins, Experience Manager Forms, InDesign, InCopy, and Substance 3D Sampler.Format PluginsCritical and high-severity code execution vulnerabilities have been patched by Adobe in Dreamweaver, Format Plugins, Experience Manager Forms, InDesign, InCopy, and Substance 3D Sampler.InCopyCritical and high-severity code execution vulnerabilities have been patched by Adobe in Dreamweaver, Format Plugins, Experience Manager Forms, InDesign, InCopy, and Substance 3D Sampler.Substance 3D SamplerCritical and high-severity code execution vulnerabilities have been patched by Adobe in Dreamweaver, Format Plugins, Experience Manager Forms, InDesign, InCopy, and Substance 3D Sampler.