-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.2373
         APSB21-45 Security Updates Available for Adobe Framemaker
                               14 July 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Adobe Framemaker
Publisher:         Adobe
Operating System:  Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-28596  

Original Bulletin: 
   https://helpx.adobe.com/security/products/framemaker/apsb21-45.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Security Updates Available for Adobe Framemaker | APSB21-45

Bulletin ID                  Date Published                Priority

APSB21-45                  July 13, 2021                     3


Summary

Adobe has released a security update for Adobe Framemaker. This update
addresses a critical vulnerability. Successful exploitation could lead to
arbitrary code execution in the context of the current user.

Affected Versions

Product                           Version                     Platform

Adobe Framemaker       2019 Update 8 and earlier                    Windows

Adobe Framemaker       2020 Release Update 1 and earlier            Windows


Solution

Adobe categorizes these updates with the following priority ratings and
recommends users update their installation to the newest version:


Product               Version          Platform  Priority   Availability

                   2019 Release Update 8                        Download Page
Adobe Framemaker   (hotfix)                 Windows   3
                                                                Tech note

Adobe Framemaker   2020 Release Update 2    Windows   3         Download Page


Vulnerability details

Vulnerability Vulnerability           CVSS
  Category       Impact     Severity  base      CVSS vector       CVE Numbers
                                     score

Out-of-bounds Arbitrary                     CVSS:3.1/AV:L/AC:L/
Write         code          Critical 7.8    PR:N/UI:R/S:U/C:H/   CVE-2021-28596
              execution                     I:H/A:H
( CWE-787 )


Acknowledgments

Adobe would like to thank Tran Van Khang - khangkito (VinCSS) working with
Trend Micro Zero Day Initiative for reporting the relevant issues and for
working with Adobe to help protect our customers.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYO4ooONLKJtyKPYoAQhAWA//aOBVTHXj7q8z97GZEwOpR/xAe2ioPTLI
b5+x3kXgyEQ3duuo225WbN4NRxJdGStzIgGgtlfZbYk+twGSr1MIKj51G4tgEnC6
dyB/M7FFVQfR+ZJsHSNINXvXfioeuSby+UMsY5qKqARKGmvSeoE3eywWczHeu5gU
gEwtcs3yVkVFmoSziYTBb8Rtt6LeDB+SwsP6SrEj2fjKj4iv6m3jqDvu5bTE5Dej
D4gWGpk06y5EJFO+gxV141GIJQ76pBFtDCZElVqc8WQ21MYV8DM+T6i1xYNknFYj
0inHZrPinm2+8jK4V+wbqtzXrHtw52DYEEnlJpv448Issxmfb33Fz7pzU9uw+MIA
oJLke9yYT2d3BY0I7BpyvBc/oLG+qpSvD/ZPxomj1H9TyMV0WB+BNbfR8B/7PJ/f
OtEsYbwm8B+UqGXaFO7VQncxMpaHGH+V5sCENDbAOPBNbDbZvUeuRBZr4ZHhXA+V
UJx5BWgB0xqoG7LY/cgLQ88JnBMI82YSemKvw7VOrkWHdIZ0W9b7ilg+DL7k0UcV
NvZSoiMJOaYRRLsDGGptecjs005UP+Bkfhq5OTiHOQ7uqNgieQeqWWtLHZDxIREz
sI2LOeKXpadwPaao7dhZl2mP3776XTK95eHO+CYz7IvCP8MXRFzjBOx05n0Jmpe2
NWrAqygb61c=
=Y8yX
-----END PGP SIGNATURE-----