Adobe Security Bulletin

Security Updates Available for Adobe Illustrator | APSB22-07

Bulletin ID

Date Published

Priority

ASPB22-07

February 8,  2022     

3

Summary

Adobe has released an update for Adobe Illustrator 2022 and Adobe Illustrator 2021. This update resolves criticalimportant and moderate vulnerabilities that could lead to privilege escalation, application denial of service, and memory leak.   
             

Affected Versions

Product

Version

Platform

Illustrator 2022

26.0.2 and earlier versions 
 

Windows and macOS

Illustrator 2021

25.4.3 and earlier versions 

Windows and macOS

Solution

Adobe categorizes these updates with the following  priority ratings  and recommends users update their installation to the newest version via the Creative Cloud desktop app's update mechanism.  For more information, please reference this help page.

Product

Version

Platform

Priority

Availability

Illustrator 2022    

26.0.3

Windows and macOS

3

Illustrator 2021    

25.4.4

Windows and macOS

3

Vulnerability details

Vulnerability Category

Vulnerability Impact

Severity

CVSS base score 

CVE Numbers

Out-of-bounds Write (CWE-787)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2022-23186

NULL Pointer Dereference (CWE-476)

Application denial-of-service

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2022-23189

Access of Memory Location After End of Buffer (CWE-788)

Memory leak

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2022-23190

Access of Memory Location After End of Buffer (CWE-788)

Memory leak

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2022-23191

Access of Memory Location After End of Buffer (CWE-788)

Memory leak

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2022-23192

Access of Memory Location After End of Buffer (CWE-788)

Memory leak

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2022-23193

Access of Memory Location After End of Buffer (CWE-788)

Memory leak

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2022-23194

Access of Memory Location After End of Buffer (CWE-788)

Memory leak

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2022-23195

Out-of-bounds Read (CWE-125)

Memory leak

Moderate

3.3

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CVE-2022-23196

Out-of-bounds Read (CWE-125)

Memory leak

Moderate

3.3

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CVE-2022-23197

NULL Pointer Dereference (CWE-476)

Application denial-of-service

Moderate

3.3

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2022-23198

NULL Pointer Dereference (CWE-476)

Application denial-of-service

Moderate

3.3

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2022-23199

Buffer Overflow (CWE-120)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2022-23188

Acknowledgments

Adobe would like to thank the following researcher for reporting these issues and for working with Adobe to help protect our customers:   

Yonghui Han of Fortinet's FortiGuard Labs - CVE-2022-23198, CVE-2022-23197, CVE-2022-23196, CVE-2022-23189, CVE-2022-23199, CVE-2022-23186

Kushal Arvind Shah of Fortinet's FortiGuard Labs - CVE-2022-23195, CVE-2022-23194, CVE-2022-23193, CVE-2022-23192, CVE-2022-23191, CVE-2022-23190, CVE-2022-23188








 




 

 


For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com

 Adobe

Get help faster and easier

New user?