PT-2020-4585 · Adobe · Indesign

Published 2020-10-20 · Updated 2021-12-10 · CVE-2020-24421

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe InDesign versions 15.1.2 and earlier

Description The issue is related to handling malformed .indd files, which can cause a NULL pointer dereference bug, potentially leading to a denial-of-service of the client application. Additionally, it is described as a memory corruption vulnerability due to insecure handling of malicious .indd files, which could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this issue.

Recommendations For Adobe InDesign versions 15.1.2 and earlier, consider avoiding the use of malicious or malformed .indd files until a patch is available. As a temporary workaround, restrict the handling of .indd files to minimize the risk of exploitation.

Fix

Buffer Overflow

NULL Pointer Dereference

Access of Memory Location After End of Buffer

Weakness Enumeration

CWE-119

CWE-476

CWE-788

Related Identifiers

BDU:2020-05134

CVE-2020-24421

Affected Products

Indesign

References · 11

• https://helpx.adobe.com/security/products/indesign/apsb20-66.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24421 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24421 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05134 · Security Note
• https://fortiguard.com/zeroday/FG-VD-20-104 · Note
• https://cybersecurity-help.cz/vdb/SB2020102120 · Note
• https://t.me/cibsecurity/15511 · Telegram Post
• https://t.me/cvenotify/14573 · Telegram Post
• https://t.me/cvenotify/15138 · Telegram Post
• https://t.me/cvenotify/7478 · Telegram Post
• https://t.me/cvenotify/16774 · Telegram Post