Multiple vulnerabilities in Adobe Prelude



| Updated: 2021-07-29
Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-36007
CVE-2021-35999
CWE-ID CWE-20
CWE-788
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Prelude
Client/Desktop applications / Multimedia software

Vendor Adobe

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU55013

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-36007

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted MP4 file and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Prelude: 7.0 - 10.0

CPE2.3 External links

https://helpx.adobe.com/security/products/prelude/apsb21-58.html
https://www.zerodayinitiative.com/advisories/ZDI-21-908/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Access of memory location after end of buffer

EUVDB-ID: #VU55014

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-35999

CWE-ID: CWE-788 - Access of Memory Location After End of Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error when processing media files. A remote attacker can trick the victim to open a specially crafted file, trigger memory corruption and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Prelude: 7.0 - 10.0

CPE2.3 External links

https://helpx.adobe.com/security/products/prelude/apsb21-58.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###