CVE-2011-0615
Multiple buffer overflows in Adobe Audition 3.0.1 and earlier allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted data in unspecified fields in the TRKM chunk in an Audition…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple buffer overflows in Adobe Audition 3.0.1 and earlier allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted data in unspecified fields in the TRKM chunk in an Audition Session (aka .ses) file, related to inconsistent use of character data types.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 6.96% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- adobe/audition
- Source
- psirt@adobe.com
References
- http://www.adobe.com/support/security/bulletins/apsb11-10.htmlVendor Advisory
- http://www.coresecurity.com/content/Adobe-Audition-malformed-SES-fileExploit
- http://www.securityfocus.com/bid/47838Exploit
- http://www.adobe.com/support/security/bulletins/apsb11-10.htmlVendor Advisory
- http://www.coresecurity.com/content/Adobe-Audition-malformed-SES-fileExploit
- http://www.securityfocus.com/bid/47838Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.