The version of Adobe After Effects installed on the remote Windows host is prior to 18.4.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-79 advisory.

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40759, CVE-2021-40760)

  - Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40751, CVE-2021-40752)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40753)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40754, CVE-2021-40758)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious SGI file in the DoReadContinue function, potentially resulting in     arbitrary code execution in the context of the current user. User interaction is required to exploit this     vulnerability. (CVE-2021-40755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Adobe After Effects < 18.4.2 Multiple Vulnerabilities (APSB21-79)

high Nessus Plugin ID 154713

Version 1.7

Version 1.6

Version 1.5

Version 1.7 Nov 28, 2024, 6:57 AM CVSSv3 score source (set to "CVE-2021-40759") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202411280657
Version 1.6 Nov 21, 2024, 2:36 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202411211436
Version 1.5 Oct 21, 2024, 7:12 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin categorization ("Agent" set to "windows") Plugin metadata Reference Plugin Feed: 202410211912