PT-2023-1930 · Adobe · Dimension

Publicado 2023-03-14 · Atualizado 2023-04-03 · CVE-2023-25895

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dimension versions 3.4.7 and earlier

Description The issue is related to a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, where a victim must open a malicious file, specifically a USD file, which can lead to the execution of arbitrary code. This is due to the improper handling of USD files, allowing an attacker to potentially execute malicious code.

Recommendations For Adobe Dimension versions 3.4.7 and earlier, update to a version that fixes the Heap-based Buffer Overflow vulnerability to prevent arbitrary code execution. As a temporary workaround, consider avoiding the use of USD files or restricting access to them until a patch is available.

Correção

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-122

Identificadores relacionados

BDU:2023-01540

CVE-2023-25895

ZDI-23-283

Produtos afetados

Dimension

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-25895 · Nota de Segurança
• https://helpx.adobe.com/security/products/dimension/apsb23-20.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-25895 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01540 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-283 · Nota de Segurança
• https://t.me/cvenotify/47399 · Publicação no Telegram
• https://cybersecurity-help.cz/vdb/SB2023031472 · Nota