PT-2024-8566 · Adobe · Bridge

Published 2024-07-09 · Updated 2024-08-02 · CVE-2024-34140

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Bridge versions 14.1 and earlier Adobe Bridge versions 14.0.4 Adobe Bridge versions 13.0.7

Description The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file. This vulnerability is associated with a file manager and may allow an attacker to reveal protected information.

Recommendations For Adobe Bridge versions 14.1 and earlier, update to a version that is not affected by this issue. For Adobe Bridge versions 14.0.4, update to a version that is not affected by this issue. For Adobe Bridge versions 13.0.7, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of file manager functions that may trigger the out-of-bounds read vulnerability until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2024-10135

CVE-2024-34140

Affected Products

Bridge

References · 6

• https://helpx.adobe.com/security/products/bridge/apsb24-51.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34140 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10135 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34140 · Security Note
• https://twitter.com/CVEnew/status/1810944996595618174 · Twitter Post
• https://t.me/cvedetector/447 · Telegram Post