Adobe Security Bulletin

Last updated on May 14, 2024

Security Updates Available for Adobe FrameMaker | APSB24-37

Bulletin ID	Date Published	Priority
APSB24-37	May 14, 2024	3

Summary

Adobe has released a security update for Adobe FrameMaker. This update addresses critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution and
memory leak.             

Affected Versions

Product	Version	Platform
Adobe FrameMaker	2020 Release Update 5 and earlier	Windows
Adobe FrameMaker	2022 Release Update 3 and earlier	Windows

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product	Version	Platform	Priority	Availability
Adobe FrameMaker	FrameMaker 2020 Update 6	Windows	3	Tech note
Adobe FrameMaker	FrameMaker 2022 Update 4	Windows	3	Tech note

Vulnerability Details

Vulnerability Category	Vulnerability Impact	Severity	CVSS base score	CVSS vector	CVE Numbers
Heap-based Buffer Overflow (CWE-122)	Arbitrary code execution	Critical	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2024-30288
Out-of-bounds Write (CWE-787)	Arbitrary code execution	Critical	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2024-30291
Buffer Overflow (CWE-120)	Arbitrary code execution	Critical	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2024-30289
Out-of-bounds Write (CWE-787)	Arbitrary code execution	Critical	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2024-30292
Out-of-bounds Write (CWE-787)	Arbitrary code execution	Critical	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CVE-2024-30290
Out-of-bounds Read (CWE-125)	Memory leak	Important	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CVE-2024-30287
Out-of-bounds Read (CWE-125)	Memory leak	Important	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CVE-2024-30286
Out-of-bounds Read (CWE-125)	Memory leak	Important	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CVE-2024-30283

Acknowledgments

Adobe would like to thank the following Initiative for reporting the relevant issues and for working with Adobe to help protect our customers:

Francis Provencher (prl)-- CVE-2024-30283, CVE-2024-30286, CVE-2024-30287, CVE-2024-30288, CVE-2024-30289, CVE-2024-30290, CVE-2024-30291, CVE-2024-30292

NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.

For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com

Get help faster and easier

New user?