PT-2022-5418 · Adobe · Dimension

Published 2022-10-11 · Updated 2022-10-18 · CVE-2022-38444

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dimension version 3.4.5

Description The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is associated with the analysis of SKP files in Adobe Dimension. Exploitation of this issue requires user interaction, where a victim must open a malicious file, potentially allowing an attacker to execute arbitrary code using a specially crafted file.

Recommendations For Adobe Dimension version 3.4.5, update to a version that fixes this issue to prevent exploitation. As a temporary workaround, consider avoiding the use of SKP files in Adobe Dimension until a patch is available. Restrict access to untrusted files to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2022-06744

CVE-2022-38444

ZDI-22-1422

Affected Products

Dimension

References · 5

• https://zerodayinitiative.com/advisories/ZDI-22-1422 · Security Note
• https://helpx.adobe.com/security/products/dimension/apsb22-57.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06744 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38444 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38444 · Vendor Advisory