Bulletin ID
Last updated on
Nov 22, 2024
Security Update Available for Adobe InDesign | APSB24-88
|
|
Date Published |
Priority |
|---|---|---|
|
APSB24-88 |
November 12 2024 |
3 |
Summary
Affected Versions
|
Product |
Affected version |
Relevant CVE |
Platform |
|
Adobe InDesign |
ID19.5 and earlier version. |
CVE-2024-49507 CVE-2024-49508 CVE-2024-49509 CVE-2024-49510 CVE-2024-49511 CVE-2024-49512 |
Windows and macOS |
|
Adobe InDesign |
ID18.5.3 and earlier version |
CVE-2024-49509 CVE-2024-49510 CVE-2024-49511 CVE-2024-49512 |
Windows and macOS |
|
Adobe InDesign |
ID18.5.2 and earlier version |
CVE-2024-49507 CVE-2024-49508 |
Windows and macOS |
Solution
Adobe categorizes these updates with the following priority rating and recommends users update their software installations via the Creative Cloud desktop app updater, or by navigating to the InDesign Help menu and clicking "Updates." For more information, please reference this help page.
|
Product |
Updated version |
Relevant CVE |
Platform |
Priority rating |
|
Adobe InDesign |
ID20.0 |
CVE-2024-49507 CVE-2024-49508 CVE-2024-49509 CVE-2024-49510 CVE-2024-49511 CVE-2024-49512 |
Windows and macOS |
3 |
|
Adobe InDesign |
ID18.5.4 |
CVE-2024-49507 CVE-2024-49508 CVE-2024-49509 CVE-2024-49510 CVE-2024-49511 CVE-2024-49512
|
Windows and macOS |
3 |
For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages. Refer to this help page for more information.
Vulnerability Details
|
Vulnerability Category |
Vulnerability Impact |
Severity |
CVSS base score |
CVE Number |
|
|---|---|---|---|---|---|
|
Heap-based Buffer Overflow (CWE-122) |
Arbitrary code execution |
Critical |
7.8 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVE-2024-49507 |
|
Heap-based Buffer Overflow (CWE-122) |
Arbitrary code execution |
Critical |
7.8 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVE-2024-49508 |
|
Heap-based Buffer Overflow (CWE-122) |
Arbitrary code execution |
Critical |
7.8 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVE-2024-49509 |
|
Out-of-bounds Read (CWE-125) |
Memory leak |
Important |
5.5 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
CVE-2024-49510 |
|
Out-of-bounds Read (CWE-125) |
Memory leak |
Important |
5.5 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
CVE-2024-49511 |
|
Out-of-bounds Read (CWE-125) |
Memory leak |
Important |
5.5 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
CVE-2024-49512 |
Acknowledgments
Adobe would like to thank the following researcher for reporting this issue and for working with Adobe to help protect our customers:
- Francis Provencher (prl) - CVE-2024-49507, CVE-2024-49508, CVE-2024-49509
- Anonymous - CVE-2024-49510, CVE-2024-49511, CVE-2024-49512
NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://hackerone.com/adobe
Revisions:
November 22, 2024 - Added clarity to Solution versioning
For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com