Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

The version of Adobe Bridge installed on the remote macOS or Mac OS X host is prior to 9.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb19-25 advisory.

  - Adobe Bridge CC versions 9.0.2 have a heap overflow vulnerability. Successful exploitation could lead to     remote code execution. (CVE-2019-7130)

  - Adobe Bridge CC versions 9.0.2 have an out-of-bounds write vulnerability. Successful exploitation could     lead to remote code execution. (CVE-2019-7132)

  - Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could     lead to information disclosure. (CVE-2019-7133, CVE-2019-7134, CVE-2019-7135, CVE-2019-7138)

  - Adobe Bridge CC versions 9.0.2 have an use after free vulnerability. Successful exploitation could lead to     information disclosure. (CVE-2019-7136)

  - Adobe Bridge CC versions 9.0.2 have a memory corruption vulnerability. Successful exploitation could lead     to information disclosure. (CVE-2019-7137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Bridge installed on the remote Windows host is prior to 9.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb19-25 advisory.

  - Adobe Bridge CC versions 9.0.2 have a heap overflow vulnerability. Successful exploitation could lead to     remote code execution. (CVE-2019-7130)

  - Adobe Bridge CC versions 9.0.2 have an out-of-bounds write vulnerability. Successful exploitation could     lead to remote code execution. (CVE-2019-7132)

  - Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could     lead to information disclosure. (CVE-2019-7133, CVE-2019-7134, CVE-2019-7135, CVE-2019-7138)

  - Adobe Bridge CC versions 9.0.2 have an use after free vulnerability. Successful exploitation could lead to     information disclosure. (CVE-2019-7136)

  - Adobe Bridge CC versions 9.0.2 have a memory corruption vulnerability. Successful exploitation could lead     to information disclosure. (CVE-2019-7137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Bridge CC installed on the remote Mac OS X host is 9.0.2. It is, therefore, affected by multiple vulnerabilities:

  - A heap buffer overflow condition exists due to improper validation of input data. A remote attacker can exploit this     issue to execute arbitrary code. (CVE-2019-7130)

  - An out-of-bounds write error exists due to a failure to handle exceptional conditions. A remote attacker can exploit     this issue to execute arbitrary code. (CVE-2019-7132)

  - Multiple out-of-bounds read errors exist. An attacker can exploit this to disclose potentially sensitive     information. (CVE-2019-7133, CVE-2019-7134, CVE-2019-7135, CVE-2019-7138)

  - A use-after-free vulnerability exists. An attacker can exploit this to disclose potentially sensitive information.
    (CVE-2019-7136)

  - An out-of-bounds memory error exists due to a failure to handle exceptional conditions. An attacker can exploit this     to disclose potentially sensitive information. (CVE-2019-7137)

ID	Name	Product	Family	Severity
209477	Adobe Bridge 9.0.2 < 9.0.3 Multiple Vulnerabilities (APSB19-25)	Nessus	MacOS X Local Security Checks	critical
124089	Adobe Bridge 9.0.2 < 9.0.3 Multiple Vulnerabilities (APSB19-25)	Nessus	Windows	critical
123976	Adobe Bridge CC 9.0.2 Multiple Vulnerabilities (APSB19-04) (Mac OS X)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2019-7134

medium

Tenable Plugins

critical

critical

critical