cnvd - cnvd-2024-46402

cnvd-2024-46402

Vulnerability from cnvd

Title: Adobe Audition缓冲区溢出漏洞（CNVD-2024-46402）

Description:

Adobe Audition是美国奥多比（Adobe）公司的一套多音轨编辑工具。该产品主要使用包含多音轨、波形和光谱显示的完善工具集对音频内容进行混音、编辑和创建等。

Adobe Audition存在缓冲区溢出漏洞，该漏洞源于允许越界读取，从而导致敏感内存泄露。目前没有详细的漏洞细节提供。

Severity: 中

Patch Name: Adobe Audition缓冲区溢出漏洞（CNVD-2024-46402）的补丁

Patch Description:

Adobe Audition存在缓冲区溢出漏洞，该漏洞源于允许越界读取，从而导致敏感内存泄露。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://helpx.adobe.com/security/products/audition/apsb24-83.html

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-49536

Impacted products

Name
['Adobe Audition <=23.6.9', 'Adobe Audition >=24.0，<24.6.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-49536",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49536"
    }
  },
  "description": "Adobe Audition\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u5957\u591a\u97f3\u8f68\u7f16\u8f91\u5de5\u5177\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u4f7f\u7528\u5305\u542b\u591a\u97f3\u8f68\u3001\u6ce2\u5f62\u548c\u5149\u8c31\u663e\u793a\u7684\u5b8c\u5584\u5de5\u5177\u96c6\u5bf9\u97f3\u9891\u5185\u5bb9\u8fdb\u884c\u6df7\u97f3\u3001\u7f16\u8f91\u548c\u521b\u5efa\u7b49\u3002\n\nAdobe Audition\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5141\u8bb8\u8d8a\u754c\u8bfb\u53d6\uff0c\u4ece\u800c\u5bfc\u81f4\u654f\u611f\u5185\u5b58\u6cc4\u9732\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://helpx.adobe.com/security/products/audition/apsb24-83.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-46402",
  "openTime": "2024-11-28",
  "patchDescription": "Adobe Audition\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u5957\u591a\u97f3\u8f68\u7f16\u8f91\u5de5\u5177\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u4f7f\u7528\u5305\u542b\u591a\u97f3\u8f68\u3001\u6ce2\u5f62\u548c\u5149\u8c31\u663e\u793a\u7684\u5b8c\u5584\u5de5\u5177\u96c6\u5bf9\u97f3\u9891\u5185\u5bb9\u8fdb\u884c\u6df7\u97f3\u3001\u7f16\u8f91\u548c\u521b\u5efa\u7b49\u3002\r\n\r\nAdobe Audition\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5141\u8bb8\u8d8a\u754c\u8bfb\u53d6\uff0c\u4ece\u800c\u5bfc\u81f4\u654f\u611f\u5185\u5b58\u6cc4\u9732\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Adobe Audition\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2024-46402\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Adobe Audition \u003c=23.6.9",
      "Adobe Audition \u003e=24.0\uff0c\u003c24.6.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-49536",
  "serverity": "\u4e2d",
  "submitTime": "2024-11-21",
  "title": "Adobe Audition\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2024-46402\uff09"
}

CVE-2024-49536 (GCVE-0-2024-49536)

Vulnerability from cvelistv5

Published

2024-11-15 19:38

Modified

2024-11-15 19:53

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-125 - Out-of-bounds Read ()

Summary

Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

References

▼	URL	Tags
	https://helpx.adobe.com/security/products/audition/apsb24-83.html	vendor-advisory

Impacted products

	Vendor	Product	Version
	Adobe	Audition	Version: 0 ≤ 24.4.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49536",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T19:53:27.469234Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T19:53:51.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Audition",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-11-12T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read (CWE-125)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-15T19:38:10.761Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/audition/apsb24-83.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Audition | Out-of-bounds Read (CWE-125)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2024-49536",
    "datePublished": "2024-11-15T19:38:10.761Z",
    "dateReserved": "2024-10-15T15:35:47.031Z",
    "dateUpdated": "2024-11-15T19:53:51.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted