Fortinet Discovers Adobe Photoshop Memory Corruption Vulnerability
Fortinet's FortiGuard Labs has discovered a memory corruption vulnerability in Adobe Photoshop.
Adobe Photoshop is a raster graphics editor developed and published by Adobe Systems. Photoshop has become the de facto industry standard in raster graphics editing. It can edit and compose raster images in multiple layers and supports masks, alpha compositing and several color models including RGB, CMYK, CIELAB, spot color and duotone. Photoshop has vast support for graphic file formats but also uses its own PSD and PSB file formats which support all the aforementioned features. In addition to raster graphics, it has limited abilities to edit or render text, vector graphics (especially through clipping path), 3D graphics and video.
A memory corruption vulnerability has been discovered in Adobe Photoshop. The vulnerability can be triggered by a crafted file which causes an out-of-bounds write, due to improper bounds checking. Successful exploitation of this vulnerability could grant an attacker remote code execution.
SolutionsFortiGuard Labs released the following FortiGate IPS signature which covers this specific vulnerability:
Released Nov 02, 2017
Users should apply the solution provided by Adobe.
Fortinet reported the vulnerability to Adobe on Sep. 11, 2017.
Adobe confirmed the vulnerability on Nov. 1, 2017.
Adobe patched the vulnerability on Nov. 14, 2017.
This vulnerability was discovered by Honggang Ren of Fortinet's FortiGuard Labs.