CVE-2020-9589: High severity Adobe Digital Negative Software Development Kit vulnerability
Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
Other sources
In DecodeImage of dnglosslessjpeg.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 8.0:2020-07-01 - Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 8.1:2020-07-01 - Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 9:2020-07-01 - Upgrade
Upgrade
android/platform/external/dng_sdkto a version that resolves this vulnerability.Fixed in 10:2020-07-01
Event History
Frequently Asked Questions
What is CVE-2020-9589?
CVE-2020-9589 is a heap overflow vulnerability in Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions.
What is the severity of CVE-2020-9589?
The severity of CVE-2020-9589 is critical with a severity value of 7.8.
How can the heap overflow vulnerability in Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions be exploited?
Successful exploitation of the heap overflow vulnerability in Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions could lead to arbitrary code execution.
Which software versions are affected by CVE-2020-9589?
Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions are affected by CVE-2020-9589.
How can I fix the heap overflow vulnerability in Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions?
To fix the heap overflow vulnerability in Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions, update to a version that is not affected by the vulnerability.