{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2018-015.pdf"
    },
    "title": "Critical Vulnerabilities in Adobe Acrobat, Reader and Photoshop CC",
    "serial_number": "2018-015",
    "publish_date": "15-05-2018 15:26:00",
    "description": "Adobe has released Adobe Security Bulletins APSB18-09 and APSB18-17 providing security updates for Adobe Acrobat, Reader and Adobe Photoshop<br>CC for Windows and MacOS. These updates address critical and important<br>vulnerabilities, which successful exploitation could lead to arbitrary<br>code execution in the context of the current user.",
    "url_title": "2018-015",
    "content_markdown": "---\ntitle: 'Critical Vulnerabilities in Adobe Acrobat, Reader and Photoshop CC'\nversion: '1.0'\nnumber: '2018-015'\ndate: 'May 15, 2018'\n---\n\n_History:_\n\n* _15/05/2018 --- v1.0: Initial publication_\n\n# Summary\n\nAdobe has released Adobe Security Bulletins APSB18-09 and APSB18-17 [3] providing security updates [1, 2] for Adobe Acrobat, Reader and Adobe Photoshop CC for Windows and MacOS. These updates address **critical and important vulnerabilities**, which successful exploitation could lead to **arbitrary code execution** in the context of the current user.\n\n# Technical Details\n\n**Critical** vulnerabilities addressed:\n\n* Double free -- Arbitrary Code Execution, CVE-2018-4990\n* Heap overflow -- Arbitrary Code execution, CVE-2018-4947, CVE-2018-4948, CVE-2018-4966, CVE-2018-4968, CVE-2018-4978, CVE-2018-4982, CVE-2018-4984\n* Use-after-free -- Arbitrary Code Execution, CVE-2018-4946, CVE-2018-4952, CVE-2018-4954, CVE-2018-4958, CVE-2018-4959, CVE-2018-4961, CVE-2018-4971, CVE-2018-4974, CVE-2018-4977, CVE-2018-4980, CVE-2018-4983, CVE-2018-4988, CVE-2018-4989\n* Out-of-bounds write -- Arbitrary Code Execution, CVE-2018-4950\n* Type confusion -- Arbitrary Code Execution,\tCVE-2018-4953\n* Untrusted pointer dereference -- Arbitrary Code Execution,\tCVE-2018-4987\n* Out-of-bounds write\t-- Remote Code Execution, CVE-2018-4946 (Adobe Photoshop CC)\n\n**Important** vulnerabilities addressed:\n\n* Security Bypass -- Information Disclosure, CVE-2018-4979\n* Out-of-bounds read, -- Information Disclosure, CVE-2018-4949, CVE-2018-4951, CVE-2018-4955, CVE-2018-4956, CVE-2018-4957, CVE-2018-4960, CVE-2018-4962, CVE-2018-4963, CVE-2018-4964, CVE-2018-4967, CVE-2018-4969, CVE-2018-4970, CVE-2018-4972, CVE-2018-4973, CVE-2018-4975, CVE-2018-4976, CVE-2018-4981, CVE-2018-4986, CVE-2018-4985\n* Memory Corruption -- Information Disclosure, CVE-2018-4965\n* NTLM SSO hash theft -- Information Disclosure, CVE-2018-4993\n* HTTP POST new line injection via XFA submission -- Security Bypass, CVE-2018-4994\n\n# Products Affected\n\n* Acrobat DC -- 2018.011.20038 and earlier versions (Windows and macOS)\n* Acrobat Reader DC -- 2018.011.20038 and earlier versions (Windows and macOS)\n* Acrobat 2017 -- 2017.011.30079 and earlier versions\t(Windows and macOS)\n* Acrobat Reader 2017 DC -- 2017.011.30079 and earlier versions\t(Windows and macOS)\n* Acrobat DC (Classic 2015) -- 2015.006.30417 and earlier versions (Windows and macOS)\n* Acrobat Reader DC (Classic 2015) -- 2015.006.30417 and earlier versions (Windows and macOS)\n* Photoshop CC 2018 -- 19.1.3 and earlier (Windows and macOS)\n* Photoshop CC 2017 -- 18.1.3 and earlier (macOS)\n* Photoshop CC 2017 -- 18.1.2 and earlier (Windows)\n\n# Recommendations\n\nAdobe recommends users to update their software installations to the latest versions by following the instructions in [1, 2].\n\n# References\n\n[1] <https://helpx.adobe.com/security/products/acrobat/apsb18-09.html>\n\n[2] <https://helpx.adobe.com/security/products/photoshop/apsb18-17.html>\n\n[3] <https://helpx.adobe.com/security.html>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>15/05/2018 --- v1.0: Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>Adobe has released Adobe Security Bulletins APSB18-09 and APSB18-17 [3] providing security updates [1, 2] for Adobe Acrobat, Reader and Adobe Photoshop CC for Windows and MacOS. These updates address <strong>critical and important vulnerabilities</strong>, which successful exploitation could lead to <strong>arbitrary code execution</strong> in the context of the current user.</p><h2 id=\"technical-details\">Technical Details</h2><p><strong>Critical</strong> vulnerabilities addressed:</p><ul><li>Double free -- Arbitrary Code Execution, CVE-2018-4990</li><li>Heap overflow -- Arbitrary Code execution, CVE-2018-4947, CVE-2018-4948, CVE-2018-4966, CVE-2018-4968, CVE-2018-4978, CVE-2018-4982, CVE-2018-4984</li><li>Use-after-free -- Arbitrary Code Execution, CVE-2018-4946, CVE-2018-4952, CVE-2018-4954, CVE-2018-4958, CVE-2018-4959, CVE-2018-4961, CVE-2018-4971, CVE-2018-4974, CVE-2018-4977, CVE-2018-4980, CVE-2018-4983, CVE-2018-4988, CVE-2018-4989</li><li>Out-of-bounds write -- Arbitrary Code Execution, CVE-2018-4950</li><li>Type confusion -- Arbitrary Code Execution, CVE-2018-4953</li><li>Untrusted pointer dereference -- Arbitrary Code Execution, CVE-2018-4987</li><li>Out-of-bounds write -- Remote Code Execution, CVE-2018-4946 (Adobe Photoshop CC)</li></ul><p><strong>Important</strong> vulnerabilities addressed:</p><ul><li>Security Bypass -- Information Disclosure, CVE-2018-4979</li><li>Out-of-bounds read, -- Information Disclosure, CVE-2018-4949, CVE-2018-4951, CVE-2018-4955, CVE-2018-4956, CVE-2018-4957, CVE-2018-4960, CVE-2018-4962, CVE-2018-4963, CVE-2018-4964, CVE-2018-4967, CVE-2018-4969, CVE-2018-4970, CVE-2018-4972, CVE-2018-4973, CVE-2018-4975, CVE-2018-4976, CVE-2018-4981, CVE-2018-4986, CVE-2018-4985</li><li>Memory Corruption -- Information Disclosure, CVE-2018-4965</li><li>NTLM SSO hash theft -- Information Disclosure, CVE-2018-4993</li><li>HTTP POST new line injection via XFA submission -- Security Bypass, CVE-2018-4994</li></ul><h2 id=\"products-affected\">Products Affected</h2><ul><li>Acrobat DC -- 2018.011.20038 and earlier versions (Windows and macOS)</li><li>Acrobat Reader DC -- 2018.011.20038 and earlier versions (Windows and macOS)</li><li>Acrobat 2017 -- 2017.011.30079 and earlier versions (Windows and macOS)</li><li>Acrobat Reader 2017 DC -- 2017.011.30079 and earlier versions (Windows and macOS)</li><li>Acrobat DC (Classic 2015) -- 2015.006.30417 and earlier versions (Windows and macOS)</li><li>Acrobat Reader DC (Classic 2015) -- 2015.006.30417 and earlier versions (Windows and macOS)</li><li>Photoshop CC 2018 -- 19.1.3 and earlier (Windows and macOS)</li><li>Photoshop CC 2017 -- 18.1.3 and earlier (macOS)</li><li>Photoshop CC 2017 -- 18.1.2 and earlier (Windows)</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>Adobe recommends users to update their software installations to the latest versions by following the instructions in [1, 2].</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://helpx.adobe.com/security/products/acrobat/apsb18-09.html\">https://helpx.adobe.com/security/products/acrobat/apsb18-09.html</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://helpx.adobe.com/security/products/photoshop/apsb18-17.html\">https://helpx.adobe.com/security/products/photoshop/apsb18-17.html</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://helpx.adobe.com/security.html\">https://helpx.adobe.com/security.html</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}