The Center for Internet Security is warning that multiple bugs in Adobe software could let an attacker take over a computer, and it is urging quick updates.
The Center for Internet Security has issued an advisory covering a long list of security flaws in Adobe products, including Photoshop, Premiere, After Effects, Audition, Media Encoder, Adobe Connect, Adobe Experience Manager, Adobe Dimension, and the Content Credentials software development kit. According to the Center for Internet Security, the most serious of these flaws could allow arbitrary code execution, meaning an attacker could run their own commands on a victim’s device.
If exploited, the worst of these vulnerabilities could let an attacker install programs, view or change files, delete data, or create new accounts with full control of the system, the Center for Internet Security says. The damage an attacker could do depends on how much access the affected user account already has; accounts with fewer privileges would limit what an attacker could do.
This affects anyone running older, unpatched versions of the listed Adobe programs, including businesses, government offices, and everyday creative professionals who use Adobe’s design and video editing tools. The Center for Internet Security rates the risk as high for large and medium businesses and government entities, medium for small organizations, and low for home users.
The good news: the Center for Internet Security says there are currently no reports of any of these flaws being used in real-world attacks. That gives Adobe customers a window to patch before anyone tries to take advantage of them.
What you can do: if you use any of the affected Adobe products, make sure your software is set to update automatically, or check manually for the latest version and install it as soon as possible after testing. The Center for Internet Security also recommends running software under accounts that don’t have administrative privileges, since this limits the damage if an attack does succeed.
Based on a release from Center for Internet Security.