—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3908
APSB23-38 : Security update available for Adobe InDesign
12 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Adobe InDesign
Publisher: Adobe
Operating System: Windows
macOS
Resolution: Patch/Upgrade
CVE Names: CVE-2023-29319 CVE-2023-29318 CVE-2023-29317
CVE-2023-29316 CVE-2023-29315 CVE-2023-29314
CVE-2023-29313 CVE-2023-29312 CVE-2023-29311
CVE-2023-29310 CVE-2023-29309 CVE-2023-29308
Original Bulletin:
https://helpx.adobe.com/security/products/indesign/apsb23-38.html
Comment: CVSS (Max): 7.8 CVE-2023-29308 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS Source: Adobe
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
– ————————–BEGIN INCLUDED TEXT——————–
Security Update Available for Adobe InDesign | APSB23-38
Bulletin ID Date Published Priority
APSB23-38 July 11, 2023 3
Summary
Adobe has released a security update for Adobe InDesign. This update addresses
critical and important vulnerabilities. Successful exploitation could lead to
arbitrary code execution and memory leak.
Affected versions
Product Affected version Platform
Adobe InDesign ID18.3 and earlier version. Windows and macOS
Adobe InDesign ID17.4.1 and earlier version. Windows and macOS
Solution
Adobe categorizes these updates with the following priority rating and
recommends users update their software installations via the Creative Cloud
desktop app updater, or by navigating to the InDesign Help menu and clicking
“Updates.” For more information, please reference this help page .
Product Updated version Platform Priority rating
Adobe InDesign ID18.4 Windows and macOS 3
Adobe InDesign ID17.4.2 Windows and macOS 3
For managed environments, IT administrators can use the Creative Cloud Packager
to create deployment packages. Refer to this help page for more information.
Vulnerability Details
Vulnerability Vulnerability CVSS
Category Impact Severity base CVSS vector CVE Number
score
Out-of-bounds Arbitrary CVSS:3.1/AV:L/AC:L/
Write ( code Critical 7.8 PR:N/UI:R/S:U/C:H/ CVE-2023-29308
CWE-787 ) execution I:H/A:H
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29309
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29310
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29311
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29312
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29313
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29314
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29315
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29316
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29317
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29318
CWE-125) I:N/A:N
Out-of-bounds CVSS:3.1/AV:L/AC:L/
Read ( Memory leak Important 5.5 PR:N/UI:R/S:U/C:H/ CVE-2023-29319
CWE-125) I:N/A:N
Acknowledgments
Adobe would like to thank the following researcher for reporting this issue and
for working with Adobe to help protect our customers:
o Yonghui Han of Fortinet’s FortiGuard Labs – CVE-2023-29308, CVE-2023-29309,
CVE-2023-29310, CVE-2023-29311, CVE-2023-29312, CVE-2023-29313,
CVE-2023-29314, CVE-2023-29315, CVE-2023-29316, CVE-2023-29317,
CVE-2023-29318, CVE-2023-29319
NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If
you are interested in working with Adobe as an external security researcher,
please fill out this form for next steps.
For more information, visit https://helpx.adobe.com/security.html , or email
[email protected]
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZK4vtskNZI30y1K9AQjYGw/+MJE8QNB+zcs8jB9kfhJuwHjznVViIcHx
f/sOfnATgccGuJo24Kbh0PL9hm+JXV+yUuKb/hSUFEiy4MzaB6IRF+cCH0A2oMz1
gloB7+6BhHDoElKNt2qf4An+dwfew774bPN4slP5+Au0a48FIYct44YGEhSLQfe6
+ihk6FZt9skzi/XVJLUHSfyNWbEis3qirU4daTpRRMyITQELXSlWznJmOWigmdmI
QgvSdZcwcegT/CCl4bgmGM26eJ1z660ilUMeDELED6NyUAKfAChU/t8LbnTRBNUU
oDNqGrmc3mQ8CpD6qBxf6YV6LvIgRX4jKljgF6i1y/VLAgvpMYw5PMQNAZBETdpf
TcH/yCbXq8MtaVhiLhMfk2/BfEG/DRYtqymJLAet9oMwZMi0Dps2xhVY6UaxwGng
5U/rg/gnMpyD+Vc2s7iIBSgdLY/pOaNr0Ql2JKkszsoJSEYyAnd+KCu2Lq9qXKvB
4cVgja2eh7pn5yaJuXlsyjtIvrz4t8+IW3aKoAsp8p0z5mfJ42Dc1JWfUUECem38
FSjtj3DRB9KKTwrsXuC3RBf+U9FsQ2W9SKx1ANS/cstcLoSWRgLG0qHYouRg/tu1
3EKkga2ViqCX/zRVSgKMJG9cH0egdxn+tF+8fTaTADQ06VK7A+7NQL2LXlAK9MiZ
qH1becFtbe8=
=AHm3
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins