WID-SEC-W-2024-2115
Vulnerability from csaf_certbund - Published: 2024-09-10 22:00 - Updated: 2024-09-10 22:00Summary
Adobe Creative Cloud Applikationen: Mehrere Schwachstellen ermöglichen Codeausführung
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Adobe Creative Cloud umfasst Anwendungen und Dienste für Video, Design, Fotografie und Web.
Angriff: Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Adobe Creative Cloud ausnutzen, um beliebigen Programmcode auszuführen und einen Denial-of-Service-Zustand zu erzeugen.
Betroffene Betriebssysteme: - MacOS X
- UNIX
- Windows
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Adobe Creative Cloud Media Encoder <24.6
Adobe / Creative Cloud
|
Media Encoder <24.6 | ||
|
Adobe Creative Cloud Media Encoder <23.6.9
Adobe / Creative Cloud
|
Media Encoder <23.6.9 |
Affected products
Known affected
2 products, the same list as for
CVE-2024-39377
Affected products
Known affected
2 products, the same list as for
CVE-2024-39377
Affected products
Known affected
2 products, the same list as for
CVE-2024-39377
Affected products
Known affected
2 products, the same list as for
CVE-2024-39377
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Adobe Creative Cloud Audition <23.6.9
Adobe / Creative Cloud
|
Audition <23.6.9 | ||
|
Adobe Creative Cloud Audition <24.6
Adobe / Creative Cloud
|
Audition <24.6 |
Affected products
Known affected
2 products, the same list as for
CVE-2024-39378
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Adobe Creative Cloud After Effects <24.6
Adobe / Creative Cloud
|
After Effects <24.6 | ||
|
Adobe Creative Cloud After Effects <23.6.9
Adobe / Creative Cloud
|
After Effects <23.6.9 |
Affected products
Known affected
2 products, the same list as for
CVE-2024-39380
Affected products
Known affected
2 products, the same list as for
CVE-2024-39380
Affected products
Known affected
2 products, the same list as for
CVE-2024-39380
Affected products
Known affected
2 products, the same list as for
CVE-2024-39380
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Adobe Creative Cloud Premiere Pro <23.6.9
Adobe / Creative Cloud
|
Premiere Pro <23.6.9 | ||
|
Adobe Creative Cloud Premiere Pro <24.6
Adobe / Creative Cloud
|
Premiere Pro <24.6 |
Affected products
Known affected
2 products, the same list as for
CVE-2024-39384
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Adobe Creative Cloud Illustrator 2023 <27.9.6
Adobe / Creative Cloud
|
Illustrator 2023 <27.9.6 | ||
|
Adobe Creative Cloud Illustrator 2024 <28.7.1
Adobe / Creative Cloud
|
Illustrator 2024 <28.7.1 |
Affected products
Known affected
2 products, the same list as for
CVE-2024-34121
Affected products
Known affected
2 products, the same list as for
CVE-2024-34121
Affected products
Known affected
2 products, the same list as for
CVE-2024-34121
Affected products
Known affected
2 products, the same list as for
CVE-2024-34121
Affected products
Known affected
2 products, the same list as for
CVE-2024-34121
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Adobe Creative Cloud ColdFusion 2023 <10
Adobe / Creative Cloud
|
ColdFusion 2023 <10 | ||
|
Adobe Creative Cloud ColdFusion 2021 <16
Adobe / Creative Cloud
|
ColdFusion 2021 <16 |
References
8 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Adobe Creative Cloud umfasst Anwendungen und Dienste f\u00fcr Video, Design, Fotografie und Web.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Adobe Creative Cloud ausnutzen, um beliebigen Programmcode auszuf\u00fchren und einen Denial-of-Service-Zustand zu erzeugen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- MacOS X\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-2115 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2115.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-2115 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2115"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB24-53 vom 2024-09-10",
"url": "https://helpx.adobe.com/security/products/media-encoder/apsb24-53.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB24-54 vom 2024-09-10",
"url": "https://helpx.adobe.com/security/products/audition/apsb24-54.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB24-55 vom 2024-09-10",
"url": "https://helpx.adobe.com/security/products/after_effects/apsb24-55.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB24-58 vom 2024-09-10",
"url": "https://helpx.adobe.com/security/products/premiere_pro/apsb24-58.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB24-66 vom 2024-09-10",
"url": "https://helpx.adobe.com/security/products/illustrator/apsb24-66.html"
},
{
"category": "external",
"summary": "Adobe Security Bulletin APSB24-71 vom 2024-09-10",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb24-71.html"
}
],
"source_lang": "en-US",
"title": "Adobe Creative Cloud Applikationen: Mehrere Schwachstellen erm\u00f6glichen Codeausf\u00fchrung",
"tracking": {
"current_release_date": "2024-09-10T22:00:00.000+00:00",
"generator": {
"date": "2026-07-16T17:09:26.181+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2024-2115",
"initial_release_date": "2024-09-10T22:00:00.000+00:00",
"revision_history": [
{
"date": "2024-09-10T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "Media Encoder \u003c24.6",
"product": {
"name": "Adobe Creative Cloud Media Encoder \u003c24.6",
"product_id": "T037478"
}
},
{
"category": "product_version",
"name": "Media Encoder 24.6",
"product": {
"name": "Adobe Creative Cloud Media Encoder 24.6",
"product_id": "T037478-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:media_encoder__24.6"
}
}
},
{
"category": "product_version_range",
"name": "Media Encoder \u003c23.6.9",
"product": {
"name": "Adobe Creative Cloud Media Encoder \u003c23.6.9",
"product_id": "T037479"
}
},
{
"category": "product_version",
"name": "Media Encoder 23.6.9",
"product": {
"name": "Adobe Creative Cloud Media Encoder 23.6.9",
"product_id": "T037479-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:media_encoder__23.6.9"
}
}
},
{
"category": "product_version_range",
"name": "Audition \u003c23.6.9",
"product": {
"name": "Adobe Creative Cloud Audition \u003c23.6.9",
"product_id": "T037480"
}
},
{
"category": "product_version",
"name": "Audition 23.6.9",
"product": {
"name": "Adobe Creative Cloud Audition 23.6.9",
"product_id": "T037480-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:audition__23.6.9"
}
}
},
{
"category": "product_version_range",
"name": "Audition \u003c24.6",
"product": {
"name": "Adobe Creative Cloud Audition \u003c24.6",
"product_id": "T037481"
}
},
{
"category": "product_version",
"name": "Audition 24.6",
"product": {
"name": "Adobe Creative Cloud Audition 24.6",
"product_id": "T037481-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:audition__24.6"
}
}
},
{
"category": "product_version_range",
"name": "After Effects \u003c24.6",
"product": {
"name": "Adobe Creative Cloud After Effects \u003c24.6",
"product_id": "T037482"
}
},
{
"category": "product_version_range",
"name": "After Effects 24.6",
"product": {
"name": "Adobe Creative Cloud After Effects 24.6",
"product_id": "T037482-fixed"
}
},
{
"category": "product_version_range",
"name": "After Effects \u003c23.6.9",
"product": {
"name": "Adobe Creative Cloud After Effects \u003c23.6.9",
"product_id": "T037483"
}
},
{
"category": "product_version_range",
"name": "After Effects 23.6.9",
"product": {
"name": "Adobe Creative Cloud After Effects 23.6.9",
"product_id": "T037483-fixed"
}
},
{
"category": "product_version_range",
"name": "ColdFusion 2023 \u003c10",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2023 \u003c10",
"product_id": "T037488"
}
},
{
"category": "product_version",
"name": "ColdFusion 2023 10",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2023 10",
"product_id": "T037488-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:coldfusion_2023__10"
}
}
},
{
"category": "product_version_range",
"name": "ColdFusion 2021 \u003c16",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2021 \u003c16",
"product_id": "T037489"
}
},
{
"category": "product_version",
"name": "ColdFusion 2021 16",
"product": {
"name": "Adobe Creative Cloud ColdFusion 2021 16",
"product_id": "T037489-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:coldfusion_2021__16"
}
}
},
{
"category": "product_version_range",
"name": "Illustrator 2024 \u003c28.7.1",
"product": {
"name": "Adobe Creative Cloud Illustrator 2024 \u003c28.7.1",
"product_id": "T037490"
}
},
{
"category": "product_version",
"name": "Illustrator 2024 28.7.1",
"product": {
"name": "Adobe Creative Cloud Illustrator 2024 28.7.1",
"product_id": "T037490-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:illustrator_2024___28.7.1"
}
}
},
{
"category": "product_version_range",
"name": "Illustrator 2023 \u003c27.9.6",
"product": {
"name": "Adobe Creative Cloud Illustrator 2023 \u003c27.9.6",
"product_id": "T037491"
}
},
{
"category": "product_version",
"name": "Illustrator 2023 27.9.6",
"product": {
"name": "Adobe Creative Cloud Illustrator 2023 27.9.6",
"product_id": "T037491-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:illustrator_2023___27.9.6"
}
}
},
{
"category": "product_version_range",
"name": "Premiere Pro \u003c23.6.9",
"product": {
"name": "Adobe Creative Cloud Premiere Pro \u003c23.6.9",
"product_id": "T037492"
}
},
{
"category": "product_version",
"name": "Premiere Pro 23.6.9",
"product": {
"name": "Adobe Creative Cloud Premiere Pro 23.6.9",
"product_id": "T037492-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:premiere_pro__23.6.9"
}
}
},
{
"category": "product_version_range",
"name": "Premiere Pro \u003c24.6",
"product": {
"name": "Adobe Creative Cloud Premiere Pro \u003c24.6",
"product_id": "T037493"
}
},
{
"category": "product_version",
"name": "Premiere Pro 24.6",
"product": {
"name": "Adobe Creative Cloud Premiere Pro 24.6",
"product_id": "T037493-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:adobe:creative_cloud:premiere_pro__24.6"
}
}
}
],
"category": "product_name",
"name": "Creative Cloud"
}
],
"category": "vendor",
"name": "Adobe"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-39377",
"product_status": {
"known_affected": [
"T037478",
"T037479"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-39377"
},
{
"cve": "CVE-2024-41870",
"product_status": {
"known_affected": [
"T037478",
"T037479"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41870"
},
{
"cve": "CVE-2024-41871",
"product_status": {
"known_affected": [
"T037478",
"T037479"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41871"
},
{
"cve": "CVE-2024-41872",
"product_status": {
"known_affected": [
"T037478",
"T037479"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41872"
},
{
"cve": "CVE-2024-41873",
"product_status": {
"known_affected": [
"T037478",
"T037479"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41873"
},
{
"cve": "CVE-2024-39378",
"product_status": {
"known_affected": [
"T037480",
"T037481"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-39378"
},
{
"cve": "CVE-2024-41868",
"product_status": {
"known_affected": [
"T037480",
"T037481"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41868"
},
{
"cve": "CVE-2024-39380",
"product_status": {
"known_affected": [
"T037482",
"T037483"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-39380"
},
{
"cve": "CVE-2024-39381",
"product_status": {
"known_affected": [
"T037482",
"T037483"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-39381"
},
{
"cve": "CVE-2024-39382",
"product_status": {
"known_affected": [
"T037482",
"T037483"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-39382"
},
{
"cve": "CVE-2024-41859",
"product_status": {
"known_affected": [
"T037482",
"T037483"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41859"
},
{
"cve": "CVE-2024-41867",
"product_status": {
"known_affected": [
"T037482",
"T037483"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41867"
},
{
"cve": "CVE-2024-39384",
"product_status": {
"known_affected": [
"T037492",
"T037493"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-39384"
},
{
"cve": "CVE-2024-39385",
"product_status": {
"known_affected": [
"T037492",
"T037493"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-39385"
},
{
"cve": "CVE-2024-34121",
"product_status": {
"known_affected": [
"T037491",
"T037490"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-34121"
},
{
"cve": "CVE-2024-41856",
"product_status": {
"known_affected": [
"T037491",
"T037490"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41856"
},
{
"cve": "CVE-2024-41857",
"product_status": {
"known_affected": [
"T037491",
"T037490"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41857"
},
{
"cve": "CVE-2024-43758",
"product_status": {
"known_affected": [
"T037491",
"T037490"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-43758"
},
{
"cve": "CVE-2024-43759",
"product_status": {
"known_affected": [
"T037491",
"T037490"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-43759"
},
{
"cve": "CVE-2024-45111",
"product_status": {
"known_affected": [
"T037491",
"T037490"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-45111"
},
{
"cve": "CVE-2024-41874",
"product_status": {
"known_affected": [
"T037488",
"T037489"
]
},
"release_date": "2024-09-10T22:00:00.000+00:00",
"title": "CVE-2024-41874"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…