PT-2021-6659 · Adobe · Animate

Published 2021-06-08 · Updated 2021-08-30 · CVE-2021-28619

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Animate versions 21.0.6 and earlier

Description The issue is related to an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file.

Recommendations For Adobe Animate versions 21.0.6 and earlier, update to a version later than 21.0.6 to resolve the issue. As a temporary workaround, consider avoiding the use of files from untrusted sources to minimize the risk of exploitation. Restrict access to sensitive information and ensure that only trusted files are opened with Adobe Animate until a patch is applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-01982

CVE-2021-28619

Affected Products

Animate

References · 7

• https://osv.dev/vulnerability/CVE-2021-28619 · Vendor Advisory
• https://helpx.adobe.com/security/products/animate/apsb21-50.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28619 · Security Note
• https://bdu.fstec.ru/vul/2022-01982 · Security Note
• https://t.me/cvenotify/20042 · Telegram Post
• https://t.me/cvenotify/20399 · Telegram Post
• https://t.me/cibsecurity/27797 · Telegram Post