Headline
CVE-2023-47075: Adobe Security Bulletin
Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security Updates Available for Adobe Illustrator | APSB23-68
Bulletin ID
Date Published
Priority
APSB23-68
December 12, 2023
3
Summary
Adobe has released an update for Adobe Illustrator. This update resolves critical vulnerabilities that could lead to arbitrary code execution.
Affected Versions
Product
Version
Platform
Illustrator 2024
28.0 and earlier versions
Windows and macOS
Illustrator 2023
27.9 and earlier versions
Windows and macOS
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism. For more information, please reference this help page.
Product
Version
Platform
Priority
Availability
Illustrator 2024
28.1
Windows and macOS
3
Download Page
Illustrator 2023
27.9.1
Windows and macOS
3
Download Page
Vulnerability Details
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Numbers
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-47074
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-47075
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-47063
Acknowledgments
Adobe would like to thank the following researchers for reporting this issue and for working with Adobe to help protect our customers:
Anonymous working with Trend Micro Zero Day Initiative – CVE-2023-47074, CVE-2023-47075
anonymous - CVE-2023-47063
NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.
For more information, visit https://helpx.adobe.com/security.html, or email [email protected]