PT-2022-2944 · Adobe · Bridge

Published 2022-04-08 · Updated 2022-11-03 · CVE-2022-28845

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Bridge versions prior to 12.0.1

Description The issue is related to an out-of-bounds write that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, where a victim must open a malicious file. This is a result of a buffer overflow in memory, allowing a potential attacker to execute arbitrary code.

Recommendations For Adobe Bridge versions prior to 12.0.1, update to a version later than 12.0.1 to resolve the issue. As a temporary workaround, consider avoiding the opening of files from untrusted sources to minimize the risk of exploitation. Restrict access to potentially malicious files to prevent the execution of arbitrary code.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-03546

CVE-2022-28845

ZDI-22-839

Affected Products

Bridge

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-28845 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28845 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03546 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-839 · Security Note
• https://helpx.adobe.com/security/products/bridge/apsb22-25.html · Vendor Advisory