====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN348
_____________________________________________________________________

DATE                : 17/06/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Adobe Premiere versions prior to
                               Pro 14.3, Rush 1.5.16.

=====================================================================
https://helpx.adobe.com/security/products/premiere_pro/apsb20-38.html
https://helpx.adobe.com/security/products/premiere_rush/apsb20-39.html
_____________________________________________________________________

Security Updates Available for Adobe Premiere Pro | APSB20-38
Bulletin ID 	Date Published 	Priority
ASPB20-38 	June 16, 2020   3


Summary

Adobe has released updates for Adobe Premiere Pro for Windows and
macOS. This update address critical vulnerabilities. Successful
exploitation could lead to arbitrary code execution in the context of
the current user.


Affected Versions

Product 	Version 	Platform
Adobe Premiere Pro  14.2 and earlier versions     Windows


Solution

Adobe categorizes these updates with the following priority ratings and
recommends users update their installation to the newest version via the
Creative Cloud desktop app’s update mechanism.  For more information,
please reference this help page.


Product 	Version    Platform   Priority Rating 	Availability
Adobe Premiere Pro 	14.3  Windows and macOS   3     Download Center

For managed environments, IT administrators can use the Admin Console to
deploy Creative Cloud applications to end users. Refer to this help page
for more information.


Vulnerability details

Vulnerability Category 	Vulnerability Impact 	Severity   CVE Numbers
Out-of-Bounds Write 	Arbitrary Code Execution  Critical CVE-2020-9653
                                                           CVE-2020-9654
Out-Of-Bounds Read 	Arbitrary Code Execution  Critical CVE-2020-9652


Acknowledgments

Adobe would like to thank Mat Powell of Trend Micro Zero Day Initiative
for reporting these issues and for working with Adobe to help protect
our customers.

_____________________________________________________________________

Security Updates Available for Adobe Premiere Rush | APSB20-39
Bulletin ID 	Date Published 	Priority
ASPB20-39 	June 16, 2020        3


Summary

Adobe has released updates for Adobe Premiere Rush for Windows and
macOS. This update address critical vulnerabilities. Successful
exploitation could lead to arbitrary code execution in the context of
the current user.  


Affected Versions

Product 	Version 	Platform
Adobe Premiere Rush  1.5.12 and earlier versions       Windows


Solution

Adobe categorizes these updates with the following priority ratings and
recommends users update their installation to the newest version via the
Creative Cloud desktop app’s update mechanism.  For more information,
please reference this help page.


Product 	Version    Platform 	Priority Rating    Availability
Adobe Premiere Rush   1.5.16   Windows and macOS    3   Download Center

For managed environments, IT administrators can use the Admin Console to
deploy Creative Cloud applications to end users. Refer to this help page
for more information.


Vulnerability details

Vulnerability Category 	Vulnerability Impact 	Severity   CVE Numbers
Out-of-Bounds Write   Arbitrary Code Execution  Critical   CVE-2020-9656
                                                           CVE-2020-9657
Out-Of-Bounds Read    Arbitrary Code Execution  Critical   CVE-2020-9655


Acknowledgments

Adobe would like to thank Mat Powell of Trend Micro Zero Day Initiative
for reporting these issues and for working with Adobe to help protect
our customers.


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================