Bulletin ID
Last updated on
Apr 28, 2022
|
Also applies to Digital Editions
Security Updates Available for Adobe After Effects | APSB21-49
|
|
Date Published |
Priority |
|---|---|---|
|
ASPB21-49 |
June 08, 2021 |
3 |
Summary
Affected Versions
|
Product |
Version |
Platform |
|---|---|---|
|
Adobe After Effects |
18.2 and earlier versions |
Windows |
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism. For more information, please reference this help page.
|
Product |
Version |
Platform |
Priority Rating |
Availability |
|---|---|---|---|---|
|
Adobe After Effects |
18.2.1 |
Windows and macOS |
3 |
|
|
Adobe After Effects |
17.7.1 |
Windows and macOS |
3 |
For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.
Vulnerability details
|
Vulnerability Category |
Vulnerability Impact |
Severity |
CVSS base score |
CVE Numbers |
|
|---|---|---|---|---|---|
|
Out-of-bounds Read (CWE-125) |
Memory leak |
Important |
5.5 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
CVE-2021-28600 |
|
NULL Pointer Dereference (CWE-476) |
Application denial-of-service |
Moderate |
3.3 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
CVE-2021-28601 |
|
Out-of-bounds Write (CWE-787) |
Arbitrary Code Execution |
Critical |
7.8 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVE-2021-28602 CVE-2021-28605 CVE-2021-28607 |
|
Heap-based Buffer Overflow (CWE-122) |
Arbitrary Code Execution |
Critical |
7.8 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVE-2021-28603 CVE-2021-28604 CVE-2021-28608 CVE-2021-28610 |
|
Stack-based Buffer Overflow (CWE-121) |
Arbitrary Code Execution |
Critical |
7.8 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVE-2021-28606 |
|
Out-of-bounds Read (CWE-125) |
Arbitrary file system read |
Important |
5.5 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
CVE-2021-28609 CVE-2021-28615 |
|
Out-of-bounds Read (CWE-125) |
Memory leak |
Important |
6.1 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L |
CVE-2021-28611 CVE-2021-28612 CVE-2021-28614 CVE-2021-28616 |
Acknowledgments
Adobe would like to thank Yongjun Liu of nsfocus security team for reporting the relevant issues and for working with Adobe to help protect our customers.
Revisions
May 12, 2021: Included details for CVE-2021-28586, CVE-2021-28587
October 25, 2021: Added Solution row for N-1 version.
April 28, 2022: Updated details for CVE-2021-28602, CVE-2021-28605, CVE-2021-28607.
For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com.