Software maker Adobe on Tuesday called attention to critical security flaws in its InDesign and ColdFusion products, warning that the defects expose users to malicious hacker attacks.
The company’s scheduled July Patch Tuesday rollout includes fixes for a dozen documented vulnerabilities in Adobe InDesign, including a bug serious enough to lead to arbitrary code execution attacks.
The Adobe InDesign update, available for Windows and macOS, fixes a critical-severity code execution flaw and 11 additional memory safety bugs that cause memory leak issues. Adobe credited Yonghui Han of Fortinet’s FortiGuard Labs with privately reporting the bugs.
A second security bulletin was also released with patches for a trio of security defects affecting Adobe ColdFusion versions 2023, 2021 and 2018.
“These updates resolve critical and important vulnerabilities that could lead to arbitrary code execution and security feature bypass,” Adobe said, calling special attention to CVE-2023-29300, a deserialization of untrusted data bug with a CVSS severity score of 9.8 out of 10.
Earlier this year, Adobe disclosed “limited attacks” exploiting a ColdFusion zero-day vulnerability.
Related: Apple Ships Urgent iOS Patch for WebKit Zero-Day
Related: Adobe Warns of Attacks Exploiting ColdFusion Zero-Day
Related: Patch Tuesday: Critical Flaws in ColdFusion, Adobe Commerce
Related: Decade-Old ColdFusion Bugs Exploited by Ransomware Gang
https://www.securityweek.com/adobe-patch-tuesday-critical-flaws-haunt-indesign-coldfusion/