Headline

CVE-2023-21578: Adobe Security Bulletin

Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

1 year ago

CVE

Open in Source

#vulnerability #mac #windows #zero_day

Security update available for Adobe Photoshop | APSB23-11

Bulletin ID

Date Published

Priority

APSB23-11

February 14,  2023

Summary

Adobe has released an update for Photoshop for Windows and macOS. This update resolves critical and important vulnerabilities.  Successful exploitation could lead to arbitrary code execution and memory leak.

Affected Versions

23.5.3 and earlier versions

24.1 and earlier versions

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism.  For more information, please reference this help page.

Product

Updated versions

Platform

Priority

Photoshop 2022

23.5.4

Windows and macOS

Photoshop 2023

24.1.1

Windows and macOS

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

Vulnerability details

Vulnerability Category

Vulnerability Impact

Severity

CVSS base score

CVSS vector

CVE Number

Improper Input Validation (CWE-20)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H