Adobe closes critical security holes in PDF tools, Photoshop and Illustrator

Adobe’s contribution to Patch Day in September is much more sparse than in August. The security vulnerabilities eliminated are spread across eight security bulletins. The PDF tools Acrobat and Acrobat Reader, ColdFusion, Illustrator, Photoshop, Audition, After Effects, Premiere Pro and Media Encoder are vulnerable. Each program has at least one vulnerability classified as critical. Attacks that would exploit one of the security vulnerabilities are not known to date. Adobe therefore assigns the lowest urgency level 3 for all updates. In August, Adobe eliminated 70 vulnerabilities in eleven product families.

The most important Adobe updates are always those for the PDF tools Acrobat and Acrobat Reader. Prepared PDF files have been used as a gateway for malware for many years. This time, the manufacturer has closed two security holes that may have been left over from the previous month. Both are classified as critical. Updates are available for Acrobat and Reader DC as well as Classic 2020 and, more recently, Acrobat 2024, each for Windows and macOS.

In Illustrator 2023 and 2024 for Windows and macOS, Adobe has eliminated six vulnerabilities, four of which the manufacturer classifies as critical. Photoshop 2023 and 2024 have five vulnerabilities, four of which are also classified as critical.

ColdFusion 2021 and 2023 have a vulnerability (CVE-2024-41874) that is classified as critical and has a high CVSS score of 9.8 (maximum score: 10). Adobe strongly recommends updating the installed Java version (JDK/JRE LTS) to the latest version. Java updates were last released in July.

▶The latest security updates

For Audition, After Effects, Media Encoder and Premiere Pro, the version numbers of the vulnerable and secured versions are the same. The number of closed security holes also varies only slightly: After Effects and Media Encoder each have five holes, and Audition and Premiere Pro each have two holes.

The latest Adobe Security Bulletins can be found on the manufacturer’s website.