PT-2021-6062 · Adobe · Indesign

Published 2021-09-15 · Updated 2022-01-15 · CVE-2021-45058

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe InDesign version 16.4 and earlier

Description The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious JPEG file. This allows a potential attacker to execute code with the privileges of the current user.

Recommendations For Adobe InDesign version 16.4 and earlier, consider avoiding the use of JPEG files from untrusted sources until a patch is available. As a temporary workaround, restrict the ability to open JPEG files in Adobe InDesign to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00660

CVE-2021-45058

ZDI-22-068

Affected Products

Indesign

References · 8

• https://zerodayinitiative.com/advisories/ZDI-22-068 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-45058 · Security Note
• https://helpx.adobe.com/security/products/indesign/apsb22-05.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00660 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45058 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022011139 · Note
• https://t.me/cibsecurity/35444 · Telegram Post
• https://t.me/cvenotify/25530 · Telegram Post