PT-2022-5423 · Adobe · Dimension

Published 2022-10-11 · Updated 2022-10-18 · CVE-2022-38448

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dimension version 3.4.5

Description The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is associated with the analysis of SKP files in Adobe Dimension. Exploitation of this issue requires user interaction, where a victim must open a malicious file, potentially allowing an attacker to execute arbitrary code using a specially crafted file.

Recommendations For Adobe Dimension version 3.4.5, update to a version that addresses this issue, as the current version is affected by the Use After Free vulnerability. As a temporary workaround, consider avoiding the use of SKP files in Adobe Dimension until a patch is available. Restrict access to potentially malicious files to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2022-06749

CVE-2022-38448

ZDI-22-1424

Affected Products

Dimension

References · 5

• https://zerodayinitiative.com/advisories/ZDI-22-1424 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38448 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06749 · Security Note
• https://helpx.adobe.com/security/products/dimension/apsb22-57.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38448 · Security Note