Headline
CVE-2023-26404: Adobe Security Bulletin
Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security updates available for Dimension | APSB23-27
Bulletin ID
Date Published
Priority
APSB23-27
April 11, 2023
3
Summary
Adobe has released an update for Adobe Dimension. This update addresses critical and important vulnerabilities in Adobe Dimension including third party dependencies. Successful exploitation could lead to memory leak and arbitrary code execution in the context of the current user.
Affected Versions
Product
Version
Platform
Adobe Dimension
3.4.8 and earlier versions
Windows and macOS
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism. For more information, please reference this help page.
Product
Version
Platform
Priority
Availability
Adobe Dimension
3.4.9
Windows and macOS
3
Download Center
For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.
Vulnerability details
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Numbers
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26372
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26373
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26374
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26375
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26376
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26377
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26378
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26379
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26380
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26381
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26382
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26400
Out-of-bounds Read (CWE-125)
Memory leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2023-26401
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26404
Out-of-bounds Read (CWE-125)
Memory leak
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-26371
Updates to Dependencies
Dependency
Vulnerability
Impact
Affected Versions
SketchUp
Access of Uninitialized Pointer (CWE-824)
Memory Leak
3.4.8 and earlier versions
Acknowledgments:
Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:
Mat Powell working with Trend Micro Zero Day Initiative - CVE-2023-26372, CVE-2023-26374
Michael DePlante (@izobashi) working with Trend Micro Zero Day Initiative - CVE-2023-26375, CVE-2023-26376, CVE-2023-26377, CVE-2023-26378, CVE-2023-26379, CVE-2023-26380, CVE-2023-26381, CVE-2023-26382, CVE-2023-26400, CVE-2023-26401, CVE-2023-26404
Qingyang Chen of Topsec Alpha Team - CVE-2023-26373
Mat Powell & Michael DePlante (@izobashi) working with Trend Micro Zero Day Initiative - CVE-2023-26371
For more information, visit https://helpx.adobe.com/security.html, or email [email protected]