PT-2024-8806 · Adobe · Indesign

Published 2024-06-21 · Updated 2024-12-03 · CVE-2024-49529

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 19.0, 20.0 and earlier

Description: The issue is related to an out-of-bounds read vulnerability in Adobe InDesign when processing JP2 files. This could allow an attacker to bypass the Address Space Layout Randomization (ASLR) protection mechanism and gain unauthorized access to sensitive information. Exploitation requires user interaction, such as opening a malicious file, and could lead to the disclosure of sensitive memory.

Recommendations: For versions 19.0 and earlier: Upgrade to a version later than 20.0 to mitigate the risk. For version 20.0: Upgrade to a version later than 20.0 to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2024-10438

CVE-2024-49529

ZDI-24-1605

Affected Products

Indesign

References · 10

• https://osv.dev/vulnerability/CVE-2024-49529 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1605 · Security Note
• https://helpx.adobe.com/security/products/indesign/apsb24-91.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10438 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49529 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-24608 · Note
• https://twitter.com/CVEnew/status/1859677187710054475 · Twitter Post
• https://twitter.com/oktsec/status/1859652575710081296 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1859836484347482148 · Twitter Post
• https://twitter.com/dailycve/status/1863970424133927054 · Twitter Post