DATABASE RESOURCES PRICING ABOUT US

{"id": "ZDI-19-907", "vendorId": null, "type": "zdi", "bulletinFamily": "info", "title": "Adobe Media Encoder CC MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability", "description": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Media Encoder CC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. Crafted data in an MP4 file can trigger a read outside the bounds of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.", "published": "2019-10-21T00:00:00", "modified": "2019-11-14T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4}, "href": "https://www.zerodayinitiative.com/advisories/ZDI-19-907/", "reporter": "Mat Powell of Trend Micro Zero Day Initiative", "references": ["https://helpx.adobe.com/security/products/media-encoder/apsb19-52.html"], "cvelist": ["CVE-2019-8243"], "immutableFields": [], "lastseen": "2022-02-10T00:00:00", "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "adobe", "idList": ["APSB19-52"]}, {"type": "cve", "idList": ["CVE-2019-8243"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310815666"]}, {"type": "threatpost", "idList": ["THREATPOST:15D2E9F142FD01B0FB329D7E3179F0E4"]}], "rev": 4}, "score": {"value": 3.9, "vector": "NONE"}, "backreferences": {"references": [{"type": "adobe", "idList": ["APSB19-52"]}, {"type": "cve", "idList": ["CVE-2019-8243"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310815666"]}, {"type": "threatpost", "idList": ["THREATPOST:15D2E9F142FD01B0FB329D7E3179F0E4"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2019-8243", "epss": "0.004050000", "percentile": "0.696550000", "modified": "2023-03-15"}], "vulnersScore": 3.9}, "_state": {"dependencies": 1645782599, "score": 1659823045, "epss": 1678948994}, "_internal": {"score_hash": "26451bd8a95a58d7cc457a1d7a8f3f6f"}}

{"cve": [{"lastseen": "2023-02-09T14:56:26", "description": "Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2019-11-14T16:15:00", "type": "cve", "title": "CVE-2019-8243", "cwe": ["CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8243"], "modified": "2021-09-08T17:22:00", "cpe": ["cpe:/a:adobe:media_encoder:13.1"], "id": "CVE-2019-8243", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8243", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:adobe:media_encoder:13.1:*:*:*:*:*:*:*"]}], "adobe": [{"lastseen": "2022-10-21T17:06:13", "description": "Adobe has released an update for Adobe Media Encoder. This update resolves a [critical]() and multiple [important]() file parsing vulnerabilities. Successful exploitation could lead to information disclosure in the context of the current user. \n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-11-12T00:00:00", "type": "adobe", "title": "APSB19-52 - Security update available for Adobe Media Encoder", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8241", "CVE-2019-8242", "CVE-2019-8243", "CVE-2019-8244", "CVE-2019-8246"], "modified": "2019-11-12T00:00:00", "id": "APSB19-52", "href": "https://helpx.adobe.com/security/products/media-encoder/apsb19-52.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-11-28T15:51:13", "description": "The host is installed with Adobe Media Encoder\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-11-14T00:00:00", "type": "openvas", "title": "Adobe Media Encoder Security Updates(APSB19-52)-Windows", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8246", "CVE-2019-8241", "CVE-2019-8244", "CVE-2019-8243", "CVE-2019-8242"], "modified": "2019-11-27T00:00:00", "id": "OPENVAS:1361412562310815666", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815666", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:adobe:media_encoder\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815666\");\n script_version(\"2019-11-27T15:23:21+0000\");\n script_cve_id(\"CVE-2019-8241\", \"CVE-2019-8242\", \"CVE-2019-8243\", \"CVE-2019-8244\",\n \"CVE-2019-8246\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-11-27 15:23:21 +0000 (Wed, 27 Nov 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-11-14 12:23:49 +0530 (Thu, 14 Nov 2019)\");\n script_name(\"Adobe Media Encoder Security Updates(APSB19-52)-Windows\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Adobe Media Encoder\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to multiple read\n and write out-of-bounds error.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to execute arbitrary code and gain access to sensitive information.\");\n\n script_tag(name:\"affected\", value:\"Adobe Media Encoder 13.1 and earlier versions\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Media Encoder 14 or later.\n Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/media-encoder/apsb19-52.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_adobe_media_encoder_detect_win.nasl\");\n script_mandatory_keys(\"adobe/mediaencoder/win/detected\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE)) exit(0);\nad_ver = infos['version'];\nad_path = infos['location'];\n\nif(version_is_less(version:ad_ver, test_version:\"14.0\"))\n{\n report = report_fixed_ver(installed_version:ad_ver, fixed_version:\"14.0\", install_path:ad_path);\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "threatpost": [{"lastseen": "2020-10-16T23:26:39", "description": "Adobe Systems is warning Illustrator 2019 users that two critical memory-corruption vulnerabilities could allow for an attacker to remotely connect to a Windows machine, execute code and gain control of the targeted system.\n\nThe create-suite behemoth also warned Tuesday, as part of its [regular monthly patch advisories](<https://blogs.adobe.com/psirt/?p=1801>), that its Windows and macOS versions of its Adobe Media Encoder also have a critical vulnerability tied to an out-of-bounds write flaw.\n\n\n\nAdobe said none of the critical bugs, nor an additional eight vulnerabilities rated important and identified Tuesday, have been exploited in the wild.\n\n**Adobe Illustrator 2019**\n\nThree security updates available for Adobe Illustrator 2019 affect version Windows 23.1 and earlier. The most serious of the bugs ([CVE-2019-8247](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8247>), [CVE-2019-8248 ](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8248>)) are both remote code execution flaws. Adobe did not go into technical detail of either bug. Mitigation includes updating to the latest version (24.0) of the software, according to the bulletin.\n\nLike both critical bugs, the additional important Illustrator vulnerability ([CVE-2019-7962](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7962>)) is also found in the Windows 23.1 and earlier versions of the software.\n\nKushal Arvind Shah of Fortinet\u2019s FortiGuard Labs are credited for finding both the critical bugs.\n\n**Adobe Media Encoder **\n\nThe free application Adobe Media Encoder, used with Adobe Premiere Pro and Adobe After Effects to transcode video suitable for the web, also received a critical fix ([CVE-2019-8246](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8246>)). Affected was the 13.1 version of the software compatible with both the Windows and macOS operating systems.\n\nThe fixes for the additional important Media Encoder bugs ([CVE-2019-8241](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8241>), [CVE-2019-8242](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8242>), [CVE-2019-8243](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8243>), [CVE-2019-8244](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8244>)), resolve multiple file parsing vulnerabilities. Successful exploitation could lead to information disclosure in the context of the current user, according to Adobe.\n\nWen Guang Jiao of Qihoo 360 Core Security is credited for finding the critical RCE bug. Adobe is urging customers to upgrade to the 14.0 version of the software.\n\n**Adobe Bridge and Animate**\n\nAdobe Bridge also received a number of important updates ([CVE-2019-8239](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8239>), [CVE-2019-8240](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8240>)), impacting both the Windows and macOS 9.1 versions of the software. Mitigation includes updating to the 10.0 version of Adobe Bridge.\n\n\u201cThis update addresses multiple vulnerabilities rated important that occur when parsing malformed SVG images. Successful exploitation could lead to information disclosure in the context of the current user,\u201d wrote Adobe.\n\nAdobe is also warning that its Animate (version 19.2.1) software for Windows is also vulnerable to a security flaw rated important. The bug ([CVE-2019-7960](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7960>)) is an \u201cinsecure library loading vulnerability that could lead to privilege escalation,\u201d according to the company.\n\nResearcher Youngjun Liu of Nsfocus is credited for discovering and reporting the Animate bug.\n\n**Insecure Defaults in Adobe\u2019s Mobile SDKs**\n\nThe Tuesday Adobe security bulletin [did not address an insecure defaults issue](<https://wwws.nightwatchcybersecurity.com/2019/11/06/insecure-defaults-in-adobes-mobile-sdks/>) with with its Adobe\u2019s mobile SDK found last week by researchers behind the Nightwatch Cybersecurity blog. That Adobe issue was addressed last week with the company stating:\n\n\u201cAdobe worked with the researcher who brought this matter to our attention to remediate the findings. Adobe released new versions of the mobile SDKs, which can be found here: <https://github.com/Adobe-Marketing-Cloud/acp-sdks>. The SDKs are configurable in Adobe Experience Platform Launch and require SSL for data transmission.\u201d\n\nNightwatch Cybersecurity had found that some default configuration files, provided by Adobe within its mobile SDKs, include several insecure options. If developers failed to change those default configuration options than corresponding live code could also be insecure.\n\n**_What are the top risks to modern enterprises in the peak era of data breaches? Find out: Join breach expert Chip Witt from SpyCloud and Threatpost senior editor Tara Seals, in our upcoming free _**[**_Threatpost webinar_**](<https://attendee.gotowebinar.com/register/3127445778613605890?source=ART>)**_, \u201cTrends in Fortune 1000 Breach Exposure.\u201d _**[**_Click here to register_**](<https://attendee.gotowebinar.com/register/3127445778613605890?source=ART>)**_._**\n", "cvss3": {}, "published": "2019-11-12T18:10:18", "type": "threatpost", "title": "Adobe Patches Critical Bugs in Illustrator, Media Encoder", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-7960", "CVE-2019-7962", "CVE-2019-8239", "CVE-2019-8240", "CVE-2019-8241", "CVE-2019-8242", "CVE-2019-8243", "CVE-2019-8244", "CVE-2019-8246", "CVE-2019-8247", "CVE-2019-8248", "CVE-2020-24400", "CVE-2020-24407"], "modified": "2019-11-12T18:10:18", "id": "THREATPOST:15D2E9F142FD01B0FB329D7E3179F0E4", "href": "https://threatpost.com/adobe-critical-bugs-illustrator-media-encoder/150114/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}