Detections
Analytics
Adobe Photoshop CC Multiple Vulnerabilities (APSB15-12)
critical Nessus Plugin ID 84403
Language:
Synopsis
The remote host has an application that is affected by multiple vulnerabilities.Description
The version of Adobe Photoshop installed on the remote host is prior or equal to CC 2014 15.2.2 (2014.2.2). It is, therefore, affected by the following vulnerabilities :- An unspecified memory corruption flaw exists due to not properly validating user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-3109)
- A integer overflow flaw exists in the GIF parser due to not properly handling a GIF file with an invalid ImageLeftPosition value. An attacker can exploit this to corrupt memory or execute arbitrary code.
(CVE-2015-3110)
- A heap-based overflow flaw exists in the PNG parser due to not properly handling a PNG file in which the CHUNK structure has an oversized length value. An attacker can exploit this to corrupt memory or execute arbitrary code.
(CVE-2015-3111)
- A memory corruption flaw exists due to not properly validating user-supplied input when handling a PDF file containing an embedded JPEG with an oversized field value. An attacker can exploit this to corrupt memory or execute arbitrary code. (CVE-2015-3112)
Solution
Upgrade to Adobe Photoshop CC 2015 16.0 (2015.0.0) or later.See Also
https://helpx.adobe.com/security/products/photoshop/apsb15-12.html
Plugin Details
Severity: Critical
ID: 84403
File Name: adobe_photoshop_apsb15-12.nasl
Version: 1.8
Type: local
Agent: windows
Family: Windows
Published: 6/26/2015
Updated: 6/27/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:adobe:photoshop, cpe:/a:adobe:photoshop_cc
Required KB Items: installed_sw/Adobe Photoshop
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/16/2015
Vulnerability Publication Date: 6/16/2015
Reference Information
CVE: CVE-2015-3109, CVE-2015-3110, CVE-2015-3111, CVE-2015-3112