Apple MACOS

ZDI-CAN-19520: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-19521: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-20285: Adobe Dimension USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-21812: Adobe Illustrator JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Use-After-Free vulnerability in the latest Adobe Acrobat Reader DC when open malicious PDF file

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously crafted file may lead to arbitrary code execution.

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to execute arbitrary code with kernel privileges.

Adobe InDesign SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Adobe InDesign SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability does not apply to Windows systems. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

ZDI-CAN-20314: Adobe Substance 3D Designer USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Adobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-20287: Adobe Substance 3D Stager USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-20255: Adobe Substance 3D Stager USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-20236: Adobe Substance 3D Stager USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-20315: Adobe Substance 3D Designer USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-CAN-20318: Adobe Substance 3D Designer DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Media Encoder | Heap-based Buffer Overflow (CWE-122)

Animate | Use After Free (CWE-416)

Animate | Use After Free (CWE-416)

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Animate | Use After Free (CWE-416)

Animate | Use After Free (CWE-416)

Animate | Use After Free (CWE-416)

Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop | Stack-based Buffer Overflow (CWE-121)

Animate | Heap-based Buffer Overflow (CWE-122)

Illustrator | Use After Free (CWE-416)

Adobe Acrobat SpellDictionaryCreate Path Traversal Remote Code Execution Vulnerability

Adobe Acrobat Reader SpellDictionaryExport Path Traversal Remote Code Execution Vulnerability

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. (When a VPN connection is initiated using a TLS/SSL client profile, the privileges are dropped, and the library will be loaded, resulting in arbitrary code execution as a user with limited privileges. This greatly reduces the impact of the vulnerability.)

Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability