Sign-up

ID

VAR-201212-0240


CVE

CVE-2012-5679


TITLE

Adobe Photoshop Camera Raw Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2012-005715

DESCRIPTION

Buffer underflow in Adobe Photoshop Camera Raw before 7.3 allows attackers to execute arbitrary code via unspecified vectors. Adobe Photoshop Camera Raw is prone to a buffer-underflow vulnerability. Successful exploits will compromise the affected application and possibly the underlying computer. Failed exploit attempts may cause a denial-of-service condition. Adobe Photoshop Camera Raw versions prior to 7.3 are vulnerable. Adobe Photoshop (PS) is a set of image processing and drawing software from Adobe Corporation of the United States. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Adobe Camera Raw Plug-in TIFF Image Processing Two Vulnerabilities SECUNIA ADVISORY ID: SA49929 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49929/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49929 RELEASE DATE: 2012-12-13 DISCUSS ADVISORY: http://secunia.com/advisories/49929/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49929/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49929 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been discovered in Adobe Camera Raw Plug-in, which can be exploited by malicious people to compromise a user's system. 1) An error in the "Camera Raw.8bi" plug-in when processing a LZW compressed TIFF image can be exploited to cause a heap-based buffer underflow via a specially crafted LZW code within an image row strip. 2) An integer overflow error in the "Camera Raw.8bi" plug-in when allocating memory during TIFF image processing can be exploited to cause a heap-based buffer overflow via specially crafted image dimensions. Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening or previewing a malicious file. The vulnerabilities are reported in the plug-in version 7.2 and prior, confirmed in: * Adobe Bridge CS6 version 5.0.0.399. SOLUTION: Update the plug-in to version 7.3 via the application's update mechanism. PROVIDED AND/OR DISCOVERED BY: 1) Francis Provencher via Secunia. 2) Dmitriy Pletnev, Secunia Research. ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2012-31/ Adobe (APSB12-28): http://www.adobe.com/support/security/bulletins/apsb12-28.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2012-5679 // JVNDB: JVNDB-2012-005715 // BID: 56922 // VULHUB: VHN-58960 // PACKETSTORM: 118823

AFFECTED PRODUCTS

vendor:adobemodel:camera rawscope:eqversion:5.2

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:3.2

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:3.4

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:2.4

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:2.3

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:3.5

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:3.3

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:3.6

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:3.1

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:2.2

Trust: 1.6

vendor:adobemodel:camera rawscope:eqversion:5.5

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:5.1

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:4.4.1

Trust: 1.0

vendor:adobemodel:camera rawscope:lteversion:7.2

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:4.1

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:5.0

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:2.1

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:4.0

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:5.4

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:4.2

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:3.7

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:4.5

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:4.3.1

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:5.3

Trust: 1.0

vendor:adobemodel:camera rawscope:eqversion:4.6

Trust: 1.0

vendor:adobemodel:photoshop camera rawscope:ltversion:7.3 (windows and macintosh)

Trust: 0.8

vendor:adobemodel:camera rawscope:eqversion:7.2

Trust: 0.3

vendor:adobemodel:camera rawscope:neversion:7.3

Trust: 0.3

sources: BID: 56922 // JVNDB: JVNDB-2012-005715 // CNNVD: CNNVD-201212-190 // NVD: CVE-2012-5679

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-5679
value: HIGH

Trust: 1.0

NVD: CVE-2012-5679
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201212-190
value: HIGH

Trust: 0.6

VULHUB: VHN-58960
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2012-5679
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-58960
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-58960 // JVNDB: JVNDB-2012-005715 // CNNVD: CNNVD-201212-190 // NVD: CVE-2012-5679

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-58960 // JVNDB: JVNDB-2012-005715 // NVD: CVE-2012-5679

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201212-190

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201212-190

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-005715

PATCH
title:APSB12-28url:http://www.adobe.com/support/security/bulletins/apsb12-28.html
Trust: 0.8
title:APSB12-28url:http://helpx.adobe.com/jp/photoshop/kb/cq11281734.html?sdid=ISBTR
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-005715

EXTERNAL IDS
db:NVDid:CVE-2012-5679
Trust: 2.8
db:JVNDBid:JVNDB-2012-005715
Trust: 0.8
db:CNNVDid:CNNVD-201212-190
Trust: 0.7
db:SECUNIAid:49929
Trust: 0.7
db:BIDid:56922
Trust: 0.4
db:SEEBUGid:SSVID-60514
Trust: 0.1
db:VULHUBid:VHN-58960
Trust: 0.1
db:PACKETSTORMid:118823
Trust: 0.1
sources:
            
            
            VULHUB: VHN-58960 // 
            
            
            
            BID: 56922 // 
            
            
            
            JVNDB: JVNDB-2012-005715 // 
            
            
            
            PACKETSTORM: 118823 // 
            
            
            
            CNNVD: CNNVD-201212-190 // 
            
            
            
            NVD: CVE-2012-5679

REFERENCES
url:http://www.adobe.com/support/security/bulletins/apsb12-28.html
Trust: 2.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-5679
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-5679
Trust: 0.8
url:http://secunia.com/advisories/49929
Trust: 0.6
url:http://www.adobe.com/products/photoshop/extend.html
Trust: 0.3
url:http://secunia.com/secunia_research/2012-31/
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=49929
Trust: 0.1
url:http://secunia.com/advisories/49929/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://secunia.com/advisories/49929/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-58960 // 
            
            
            
            BID: 56922 // 
            
            
            
            JVNDB: JVNDB-2012-005715 // 
            
            
            
            PACKETSTORM: 118823 // 
            
            
            
            CNNVD: CNNVD-201212-190 // 
            
            
            
            NVD: CVE-2012-5679

CREDITS
Francis Provencher via Secunia
Trust: 0.3
sources:
            
            
            BID: 56922

SOURCES
db:VULHUBid:VHN-58960
db:BIDid:56922
db:JVNDBid:JVNDB-2012-005715
db:PACKETSTORMid:118823
db:CNNVDid:CNNVD-201212-190
db:NVDid:CVE-2012-5679

LAST UPDATE DATE
2025-04-11T23:01:52.374000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-58960date:2012-12-13T00:00:00
db:BIDid:56922date:2012-12-12T00:00:00
db:JVNDBid:JVNDB-2012-005715date:2012-12-14T00:00:00
db:CNNVDid:CNNVD-201212-190date:2012-12-14T00:00:00
db:NVDid:CVE-2012-5679date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-58960date:2012-12-13T00:00:00
db:BIDid:56922date:2012-12-12T00:00:00
db:JVNDBid:JVNDB-2012-005715date:2012-12-14T00:00:00
db:PACKETSTORMid:118823date:2012-12-13T06:14:35
db:CNNVDid:CNNVD-201212-190date:2012-12-14T00:00:00
db:NVDid:CVE-2012-5679date:2012-12-13T11:53:49.227