PT-2017-2366 · Adobe · Photoshop

Published 2017-04-12 · Updated 2019-05-10 · CVE-2017-3004

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Photoshop versions CC 2017 (18.0.1) and earlier Adobe Photoshop versions CC 2015.5.1 (17.0.1) and earlier

Description The issue is caused by a memory corruption vulnerability when parsing malicious PCX files, which could lead to arbitrary code execution. It is also described as a buffer overflow vulnerability that allows a remote attacker to execute arbitrary code during the parsing of malicious files.

Recommendations For Adobe Photoshop versions CC 2017 (18.0.1) and earlier, update to a version later than 18.0.1 to resolve the issue. For Adobe Photoshop versions CC 2015.5.1 (17.0.1) and earlier, update to a version later than 17.0.1 to resolve the issue. As a temporary workaround, consider avoiding the use of PCX files in Adobe Photoshop until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-01566

CVE-2017-3004

Affected Products

Photoshop

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-3004 · Security Note
• https://helpx.adobe.com/security/products/photoshop/apsb17-12.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3004 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01566 · Security Note
• http://securitytracker.com/id/1038229 · Note
• http://securityfocus.com/bid/97559 · Note