Headline
CVE-2022-28852: Adobe Security Bulletin
Adobe InDesign versions 16.4.2 (and earlier) and 17.3 (and earlier) are affected by by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security Update Available for Adobe InDesign | APSB22-50
Bulletin ID
Date Published
Priority
APSB22-50
September 13, 2022
3
Summary
Adobe has released a security update for Adobe InDesign. This update addresses multiple critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution, arbitrary file system read
and memory leak.
Affected versions
17.3 and earlier versions
16.4.2 and earlier versions
Solution
Adobe categorizes these updates with the following priority rating and recommends users update their software installations via the Creative Cloud desktop app updater, or by navigating to the InDesign Help menu and clicking “Updates.” For more information, please reference this help page.
Product
Updated version
Platform
Priority rating
Adobe InDesign
17.4
Windows and macOS
3
Adobe InDesign
16.4.3
Windows and macOS
3
For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages. Refer to this help page for more information.
Vulnerability Details
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Number
Improper Input Validation (CWE-20)
Arbitrary file system read
Critical
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2019-17221*
*Updating open-source PhantomJS library
*This CVE is only available in the latest version, ID 17.4
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-28852
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-28853
Out-of-bounds Read (CWE-125)
Memory Leak
Imortant
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-28854
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-28855
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-28856
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-28857
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-30671
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-30672
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-30673
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-30674
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-30675
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-30676
Heap-based Buffer Overflow (CWE-122)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-38413
Heap-based Buffer Overflow (CWE-122)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-38414
Heap-based Buffer Overflow (CWE-122)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-38415
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-38416
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-38417
Acknowledgments
Adobe would like to thank the following researcher for reporting this issue and for working with Adobe to help protect our customers:
- Yonghui Han of Fortinet’s FortiGuard Labs - CVE-2022-28852, CVE-2022-28853, CVE-2022-28854, CVE-2022-28855, CVE-2022-28856, CVE-2022-28857, CVE-2022-30671, CVE-2022-30672, CVE-2022-30673, CVE-2022-30674, CVE-2022-30675, CVE-2022-30676
- Mat Powell of Trend Micro Zero Day Initiative - CVE-2022-38413, CVE-2022-38414, CVE-2022-38415, CVE-2022-38416, CVE-2022-38417
Revisions:
- July 13, 2022: Bulletin APSB22-30 revised to include (CVE-2022-34245, CVE-2022-34246, CVE-2022-34247, CVE-2022-34248)
- July 16, 2022: Changed CVE-2022-28851 to 3rd party open-source library vulnerability PhantomJS CVE-2019-17221
Related news
Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.