Adobe provides security updates for three product groups in September that eliminate a total of five vulnerabilities.
On Update Tuesday on September 12, Adobe released several security updates to close five vulnerabilities in several programs, some of which are classified as critical. These affect the PDF tools Acrobat and Acrobat Reader, Connect, and Experience Manager. More worryingly, a vulnerability in the PDF tools is already being attacked. Adobe therefore assigns the highest priority level 1 to the PDF updates and the lowest priority level 3 to the others.
Adobe Updates in September
| Product | vulnerable version(s) | vulnerable version(s) | Vulnerabilities | Risk |
|---|---|---|---|---|
| Acrobat and Reader DC | 23.003.20284 and older | 23.006.20320 | 1 | critical |
| Acrobat and Reader 2020 | 20.005.30516 and older | 20.005.30524 | 1 | critical |
| Experience Manager (AEM) | 6.5.17.0 and older | 6.5.18.0 | 2 | high |
| AEM | AEM Cloud Service (CS) | 2023.8 | 2 | high |
| Connect | 12.3 and older | 12.4.1 | 2 | high |
In August, Adobe fixed 30 vulnerabilities in its PDF tools, Acrobat and Acrobat Reader. In September, only one more is added — but it’s a doozy. Adobe classifies the vulnerability CVE-2023-26369 as critical. An attacker could inject and execute code with specially prepared PDF files. This is apparently already happening in “limited” attacks, according to Adobe. The remedy is updates for Acrobat and Reader DC as well as Acrobat and Reader 2020 (see table).
The Adobe Experience Manager (AEM) has two cross-site scripting (XSS) vulnerabilities (CVE-2023-38214, -38215) up to and including version 6.5.17.0. They could allow an attacker to execute arbitrary code and are considered high risk. The AEM Cloud Service is also affected. Those who use it will automatically receive an update to release 2023.8. For AEM 6.5, the manufacturer offers an update to the secure version 6.5.18.0.
The presentation solution Connect also contains two such XSS vulnerabilities (CVE-2023-29305, -29306), which Adobe classifies as high risk. All versions up to and including 12.3 are vulnerable. The vulnerabilities will be closed with the update to version 12.4.1.
