PT-2023-1930 · Adobe · Dimension

Published 2023-03-14 · Updated 2023-04-03 · CVE-2023-25895

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dimension versions 3.4.7 and earlier

Description The issue is related to a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, where a victim must open a malicious file, specifically a USD file, which can lead to the execution of arbitrary code. This is due to the improper handling of USD files, allowing an attacker to potentially execute malicious code.

Recommendations For Adobe Dimension versions 3.4.7 and earlier, update to a version that fixes the Heap-based Buffer Overflow vulnerability to prevent arbitrary code execution. As a temporary workaround, consider avoiding the use of USD files or restricting access to them until a patch is available.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2023-01540

CVE-2023-25895

ZDI-23-283

Affected Products

Dimension

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-25895 · Security Note
• https://helpx.adobe.com/security/products/dimension/apsb23-20.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25895 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01540 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-283 · Security Note
• https://t.me/cvenotify/47399 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023031472 · Note