CVE-2022-30646
Vulnerability from cvelistv5
Published
2023-09-07 13:12
Modified
2024-08-03 06:56
Severity ?
EPSS score ?
Summary
Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References
▼ | URL | Tags | |
---|---|---|---|
psirt@adobe.com | https://helpx.adobe.com/security/products/illustrator/apsb22-26.html | Patch, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://helpx.adobe.com/security/products/illustrator/apsb22-26.html | Patch, Vendor Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Adobe | Illustrator |
Version: 0 ≤ 25.4.5 |
|
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T06:56:13.251Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "vendor-advisory", "x_transferred", ], url: "https://helpx.adobe.com/security/products/illustrator/apsb22-26.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "affected", product: "Illustrator", vendor: "Adobe", versions: [ { lessThanOrEqual: "25.4.5", status: "affected", version: "0", versionType: "semver", }, ], }, ], datePublic: "2022-06-14T17:00:00.000Z", descriptions: [ { lang: "en", value: "Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", availabilityRequirement: "NOT_DEFINED", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", confidentialityRequirement: "NOT_DEFINED", environmentalScore: 7.8, environmentalSeverity: "HIGH", exploitCodeMaturity: "NOT_DEFINED", integrityImpact: "HIGH", integrityRequirement: "NOT_DEFINED", modifiedAttackComplexity: "LOW", modifiedAttackVector: "LOCAL", modifiedAvailabilityImpact: "HIGH", modifiedConfidentialityImpact: "HIGH", modifiedIntegrityImpact: "HIGH", modifiedPrivilegesRequired: "NONE", modifiedScope: "NOT_DEFINED", modifiedUserInteraction: "REQUIRED", privilegesRequired: "NONE", remediationLevel: "NOT_DEFINED", reportConfidence: "NOT_DEFINED", scope: "UNCHANGED", temporalScore: 7.8, temporalSeverity: "HIGH", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-787", description: "Out-of-bounds Write (CWE-787)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-09-07T13:12:06.461Z", orgId: "078d4453-3bcd-4900-85e6-15281da43538", shortName: "adobe", }, references: [ { tags: [ "vendor-advisory", ], url: "https://helpx.adobe.com/security/products/illustrator/apsb22-26.html", }, ], source: { discovery: "EXTERNAL", }, title: "Adobe Illustrator Font Parsing Out-of-bounds Write Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "078d4453-3bcd-4900-85e6-15281da43538", assignerShortName: "adobe", cveId: "CVE-2022-30646", datePublished: "2023-09-07T13:12:06.461Z", dateReserved: "2022-05-12T21:38:57.909Z", dateUpdated: "2024-08-03T06:56:13.251Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"25.4.5\", \"matchCriteriaId\": \"25E27770-27F5-4E91-94BD-C2091B3610F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"26.0\", \"versionEndIncluding\": \"26.0.2\", \"matchCriteriaId\": \"77D1A8DD-C35A-440E-9403-9C8B93B4BDCA\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"387021A0-AF36-463C-A605-32EA7DAC172E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\"}, {\"lang\": \"es\", \"value\": \"Las versiones 26.0.2 (y anteriores) y 25.4.5 (y anteriores) de Adobe Illustrator est\\u00e1n afectadas por una vulnerabilidad de escritura fuera de los l\\u00edmites que podr\\u00eda dar lugar a la ejecuci\\u00f3n de c\\u00f3digo arbitrario en el contexto del usuario actual. La explotaci\\u00f3n de este problema requiere la interacci\\u00f3n del usuario, ya que la v\\u00edctima debe abrir un archivo malicioso. \"}]", id: "CVE-2022-30646", lastModified: "2024-11-21T07:03:05.770", metrics: "{\"cvssMetricV31\": [{\"source\": \"psirt@adobe.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}", published: "2023-09-07T14:15:11.183", references: "[{\"url\": \"https://helpx.adobe.com/security/products/illustrator/apsb22-26.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://helpx.adobe.com/security/products/illustrator/apsb22-26.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]", sourceIdentifier: "psirt@adobe.com", vulnStatus: "Modified", weaknesses: "[{\"source\": \"psirt@adobe.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2022-30646\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2023-09-07T14:15:11.183\",\"lastModified\":\"2024-11-21T07:03:05.770\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.\"},{\"lang\":\"es\",\"value\":\"Las versiones 26.0.2 (y anteriores) y 25.4.5 (y anteriores) de Adobe Illustrator están afectadas por una vulnerabilidad de escritura fuera de los límites que podría dar lugar a la ejecución de código arbitrario en el contexto del usuario actual. La explotación de este problema requiere la interacción del usuario, ya que la víctima debe abrir un archivo malicioso. \"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@adobe.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"25.4.5\",\"matchCriteriaId\":\"25E27770-27F5-4E91-94BD-C2091B3610F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"26.0\",\"versionEndIncluding\":\"26.0.2\",\"matchCriteriaId\":\"77D1A8DD-C35A-440E-9403-9C8B93B4BDCA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"387021A0-AF36-463C-A605-32EA7DAC172E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://helpx.adobe.com/security/products/illustrator/apsb22-26.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://helpx.adobe.com/security/products/illustrator/apsb22-26.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}", }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.