CVE-2021-43018: Adobe Security Bulletin

Security update available for Adobe Photoshop | APSB21-113

Bulletin ID

Date Published

Priority

APSB21-113

December 14,  2021

3

Summary

Adobe has released an update for Photoshop for Windows and macOS. This update resolves a critical  and important vulnerability.  Successful exploitation could lead to arbitrary code execution and memory leak in the context of the current user.

Affected Versions

22.5.3 and earlier versions

23.0.2 and earlier versions

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism.  For more information, please reference this help page.

Product

Updated versions

Platform

Priority

Photoshop 2021

22.5.4

Windows and macOS

3

Photoshop 2022

23.1

Windows and macOS

3

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

Vulnerability details

Vulnerability Category

Vulnerability Impact

Severity

CVSS base score

CVSS vector

CVE Number

Out-of-bounds Write (CWE-787)

Arbitrary code execution

Critical

7.8

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2021-43018

Access of Memory Location After End of Buffer (CWE-788)

Memory Leak

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2021-43020

Buffer Overflow (CWE-120)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2021-44184

Acknowledgments

Adobe would like to thank the following researcher for reporting this issue and for working with Adobe to help protect our customers:

• Mat Powell working with Trend Micro Zero Day Initiative (CVE-2021-43018)

• Kushal Arvind Shah of Fortinet’s FortiGuard Labs (CVE-2021-43020 and CVE-2021-44184)

For more information, visit https://helpx.adobe.com/security.html, or email [email protected].