diff --git a/repository/definitions/inventory/oval_org.cisecurity_def_7159.xml b/repository/definitions/inventory/oval_org.cisecurity_def_7159.xml index e50610027a0a..a231565107e1 100644 --- a/repository/definitions/inventory/oval_org.cisecurity_def_7159.xml +++ b/repository/definitions/inventory/oval_org.cisecurity_def_7159.xml @@ -1,4 +1,4 @@ - + Adobe Bridge is installed diff --git a/repository/definitions/inventory/oval_org.cisecurity_def_8775.xml b/repository/definitions/inventory/oval_org.cisecurity_def_8775.xml index 97bd1ba9ea0f..1154627181c2 100644 --- a/repository/definitions/inventory/oval_org.cisecurity_def_8775.xml +++ b/repository/definitions/inventory/oval_org.cisecurity_def_8775.xml @@ -1,4 +1,4 @@ - + Adobe Animate is installed diff --git a/repository/definitions/inventory/oval_org.cisecurity_def_8776.xml b/repository/definitions/inventory/oval_org.cisecurity_def_8776.xml index a936366b3c36..2d95fece6e90 100644 --- a/repository/definitions/inventory/oval_org.cisecurity_def_8776.xml +++ b/repository/definitions/inventory/oval_org.cisecurity_def_8776.xml @@ -1,4 +1,4 @@ - + Adobe Media Encoder is installed diff --git a/repository/definitions/inventory/oval_org.mitre.oval_def_26684.xml b/repository/definitions/inventory/oval_org.mitre.oval_def_26684.xml index 5f37da67ffb8..6162ef3ce52d 100644 --- a/repository/definitions/inventory/oval_org.mitre.oval_def_26684.xml +++ b/repository/definitions/inventory/oval_org.mitre.oval_def_26684.xml @@ -1,4 +1,4 @@ - + Adobe Digital Editions is installed diff --git a/repository/definitions/inventory/oval_org.mitre.oval_def_6647.xml b/repository/definitions/inventory/oval_org.mitre.oval_def_6647.xml index feb082ff19b3..32cf21d9bdb1 100644 --- a/repository/definitions/inventory/oval_org.mitre.oval_def_6647.xml +++ b/repository/definitions/inventory/oval_org.mitre.oval_def_6647.xml @@ -1,4 +1,4 @@ - + Adobe Photoshop is installed diff --git a/repository/definitions/vulnerability/oval_com.gfi_def_1521.xml b/repository/definitions/vulnerability/oval_com.gfi_def_1521.xml deleted file mode 100644 index 1b72060a473c..000000000000 --- a/repository/definitions/vulnerability/oval_com.gfi_def_1521.xml +++ /dev/null @@ -1,43 +0,0 @@ - - - Multiple vulnerabilities on Adobe Media Encoder - - Microsoft Windows 10 - Microsoft Windows Server 2008 - Microsoft Windows Server 2008 R2 - Microsoft Windows Server 2012 - Microsoft Windows Server 2012 R2 - Microsoft Windows Server 2016 - Microsoft Windows Server 2019 - Adobe Media Encoder - - - - - - Adobe Media Encoder version 13.0.2 has a use-after-free vulnerability (CVE-2019-7842) - and an out-of-bounds read vulnerability (CVE-2019-7844). Successful exploitation could - lead to remote code execution. - - - - - Glenn Lugod - - - INITIAL SUBMISSION - 5.10 - - - - - - - \ No newline at end of file diff --git a/repository/definitions/vulnerability/oval_com.gfi_def_1524.xml b/repository/definitions/vulnerability/oval_com.gfi_def_1524.xml deleted file mode 100644 index 4219769fb8c7..000000000000 --- a/repository/definitions/vulnerability/oval_com.gfi_def_1524.xml +++ /dev/null @@ -1,54 +0,0 @@ - - - Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing - vulnerability. (CVE-2019-7107) - - Microsoft Windows 7 - Microsoft Windows 8 - Microsoft Windows 8.1 - Microsoft Windows 10 - Microsoft Windows Server 2003 - Microsoft Windows Server 2008 - Microsoft Windows Server 2008 R2 - Microsoft Windows Server 2012 - Microsoft Windows Server 2012 R2 - Adobe InDesign - - - - - Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing - vulnerability. Successful exploitation could lead to arbitrary code execution. Fixed in - versions 13.1.1 and 14.0.2. (CVE-2019-7107) - - - - - Glenn Lugod - - - INITIAL SUBMISSION - 5.10 - - - - - - - - - - - - - \ No newline at end of file diff --git a/repository/definitions/vulnerability/oval_com.gfi_def_1529.xml b/repository/definitions/vulnerability/oval_com.gfi_def_1529.xml deleted file mode 100644 index d66aa63f0258..000000000000 --- a/repository/definitions/vulnerability/oval_com.gfi_def_1529.xml +++ /dev/null @@ -1,51 +0,0 @@ - - - - Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow - vulnerability. (CVE-2019-7095) - - - Microsoft Windows 2000 - Microsoft Windows XP - Microsoft Windows Server 2003 - Microsoft Windows Vista - Microsoft Windows Server 2008 - Microsoft Windows Server 2008 R2 - Microsoft Windows 7 - Microsoft Windows 8 - Microsoft Windows 8.1 - Microsoft Windows 10 - Microsoft Windows Server 2012 - Microsoft Windows Server 2012 R2 - Microsoft Windows Server 2016 - Microsoft Windows Server 2019 - Adobe Digital Editions - - - - - Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow - vulnerability. Successful exploitation could lead to arbitrary code execution. - (CVE-2019-7095) - - - - - Glenn Lugod - - - INITIAL SUBMISSION - 5.10 - - - - - - - \ No newline at end of file diff --git a/repository/definitions/vulnerability/oval_com.gfi_def_1532.xml b/repository/definitions/vulnerability/oval_com.gfi_def_1532.xml deleted file mode 100644 index b42a2d106af6..000000000000 --- a/repository/definitions/vulnerability/oval_com.gfi_def_1532.xml +++ /dev/null @@ -1,82 +0,0 @@ - - - Multiple vulnerabilities on Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 - (and earlier) - - Microsoft Windows 8 - Microsoft Windows 8.1 - Microsoft Windows 10 - Microsoft Windows 11 - Microsoft Windows Server 2012 - Microsoft Windows Server 2012 R2 - Microsoft Windows Server 2016 - Microsoft Windows Server 2019 - Adobe Bridge - - - - - - - - - - - Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an - out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An - attacker could leverage this vulnerability to bypass mitigations such as ASLR. - Exploitation of this issue requires user interaction in that a victim must open a - malicious file. (CVE-2023-21583) - Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by a - Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution - in the context of the current user. Exploitation of this issue requires user interaction - in that a victim must open a malicious file. (CVE-2023-22226) - Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an - out-of-bounds write vulnerability that could result in arbitrary code execution in the - context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-22227) - Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an - Improper Input Validation vulnerability that could result in arbitrary code execution in - the context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-22228) - Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an - out-of-bounds write vulnerability that could result in arbitrary code execution in the - context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-22229) - Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an - out-of-bounds write vulnerability that could result in arbitrary code execution in the - context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-22230) - Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an - out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An - attacker could leverage this vulnerability to bypass mitigations such as ASLR. - Exploitation of this issue requires user interaction in that a victim must open a - malicious file. (CVE-2023-22231) - - - - - Glenn Lugod - - - INITIAL SUBMISSION - 5.10 - - - - - - - \ No newline at end of file diff --git a/repository/definitions/vulnerability/oval_com.gfi_def_1535.xml b/repository/definitions/vulnerability/oval_com.gfi_def_1535.xml deleted file mode 100644 index 330fa0bc5a07..000000000000 --- a/repository/definitions/vulnerability/oval_com.gfi_def_1535.xml +++ /dev/null @@ -1,83 +0,0 @@ - - - Multiple vulnerabilites on Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) - - Microsoft Windows 8 - Microsoft Windows 8.1 - Microsoft Windows 10 - Microsoft Windows 11 - Microsoft Windows Server 2012 - Microsoft Windows Server 2012 R2 - Microsoft Windows Server 2016 - Microsoft Windows Server 2019 - Adobe Photoshop - - - - - - - - - Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper - Input Validation vulnerability that could result in arbitrary code execution in the - context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-21574) - Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an - out-of-bounds write vulnerability that could result in arbitrary code execution in the - context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-21575) - Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an - out-of-bounds write vulnerability that could result in arbitrary code execution in the - context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-21576) - Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an - out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An - attacker could leverage this vulnerability to bypass mitigations such as ASLR. - Exploitation of this issue requires user interaction in that a victim must open a - malicious file. (CVE-2023-21577) - Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an - out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An - attacker could leverage this vulnerability to bypass mitigations such as ASLR. - Exploitation of this issue requires user interaction in that a victim must open a - malicious file. (CVE-2023-21578) - - - - - Glenn Lugod - - - INITIAL SUBMISSION - 5.10 - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/repository/definitions/vulnerability/oval_com.gfi_def_1544.xml b/repository/definitions/vulnerability/oval_com.gfi_def_1544.xml deleted file mode 100644 index b5982c5f098b..000000000000 --- a/repository/definitions/vulnerability/oval_com.gfi_def_1544.xml +++ /dev/null @@ -1,58 +0,0 @@ - - - Adobe InDesign versions ID18.1 (and earlier) and ID17.4 (and earlier) are affected by - a NULL Pointer Dereference vulnerability. (CVE-2023-21593) - - Microsoft Windows 7 - Microsoft Windows 8 - Microsoft Windows 8.1 - Microsoft Windows 10 - Microsoft Windows 11 - Microsoft Windows Server 2003 - Microsoft Windows Server 2008 - Microsoft Windows Server 2008 R2 - Microsoft Windows Server 2012 - Microsoft Windows Server 2012 R2 - Adobe InDesign - - - - - Adobe InDesign versions ID18.1 (and earlier) and ID17.4 (and earlier) are affected by a - NULL Pointer Dereference vulnerability. - An unauthenticated attacker could leverage this vulnerability to achieve an application - denial-of-service in the context of the current user. - Exploitation of this issue requires user interaction in that a victim must open a - malicious file. (CVE-2023-21593) - - - - - Glenn Lugod - - - INITIAL SUBMISSION - 5.10 - - - - - - - - - - - - - \ No newline at end of file diff --git a/repository/definitions/vulnerability/oval_com.gfi_def_1549.xml b/repository/definitions/vulnerability/oval_com.gfi_def_1549.xml deleted file mode 100644 index 19a70cdfa66a..000000000000 --- a/repository/definitions/vulnerability/oval_com.gfi_def_1549.xml +++ /dev/null @@ -1,64 +0,0 @@ - - - Multiple vulnerabilities on Adobe Animate 2022, Adobe Animate 2023 - - Microsoft Windows 10 - Microsoft Windows 11 - Microsoft Windows Server 2008 - Microsoft Windows Server 2008 R2 - Microsoft Windows Server 2012 - Microsoft Windows Server 2012 R2 - Microsoft Windows Server 2016 - Microsoft Windows Server 2019 - Adobe Animate - - - - - - - Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a - Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution - in the context of the current user. Exploitation of this issue requires user interaction - in that a victim must open a malicious file. (CVE-2023-22236) - Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a - Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution - in the context of the current user. Exploitation of this issue requires user interaction - in that a victim must open a malicious file. (CVE-2023-22243) - Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a - Use After Free vulnerability that could result in arbitrary code execution in the - context of the current user. Exploitation of this issue requires user interaction in - that a victim must open a malicious file. (CVE-2023-22246) - - - - - Glenn Lugod - - - INITIAL SUBMISSION - 5.10 - - - - - - - - - - - - - \ No newline at end of file diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_9466.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_9466.xml new file mode 100644 index 000000000000..2b4df38c30f9 --- /dev/null +++ b/repository/definitions/vulnerability/oval_org.cisecurity_def_9466.xml @@ -0,0 +1,37 @@ + + + Multiple vulnerabilities on Adobe Media Encoder + + Microsoft Windows 10 + Microsoft Windows Server 2008 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2012 + Microsoft Windows Server 2012 R2 + Microsoft Windows Server 2016 + Microsoft Windows Server 2019 + Adobe Media Encoder + + + + + + Adobe Media Encoder version 13.0.2 has a use-after-free vulnerability (CVE-2019-7842) + and an out-of-bounds read vulnerability (CVE-2019-7844). Successful exploitation could + lead to remote code execution. + + + + + Glenn Lugod + + DRAFT + + DRAFT + 5.10 + + + + + + + diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_9467.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_9467.xml new file mode 100644 index 000000000000..780f387611e0 --- /dev/null +++ b/repository/definitions/vulnerability/oval_org.cisecurity_def_9467.xml @@ -0,0 +1,45 @@ + + + Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing + vulnerability. (CVE-2019-7107) + + Microsoft Windows 7 + Microsoft Windows 8 + Microsoft Windows 8.1 + Microsoft Windows 10 + Microsoft Windows Server 2003 + Microsoft Windows Server 2008 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2012 + Microsoft Windows Server 2012 R2 + Adobe InDesign + + + + + Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing + vulnerability. Successful exploitation could lead to arbitrary code execution. Fixed in + versions 13.1.1 and 14.0.2. (CVE-2019-7107) + + + + + Glenn Lugod + + DRAFT + + DRAFT + 5.10 + + + + + + + + + + + + + diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_9468.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_9468.xml new file mode 100644 index 000000000000..979732f456fa --- /dev/null +++ b/repository/definitions/vulnerability/oval_org.cisecurity_def_9468.xml @@ -0,0 +1,54 @@ + + + Multiple vulnerabilities on Adobe Animate 2022, Adobe Animate 2023 + + Microsoft Windows 10 + Microsoft Windows 11 + Microsoft Windows Server 2008 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2012 + Microsoft Windows Server 2012 R2 + Microsoft Windows Server 2016 + Microsoft Windows Server 2019 + Adobe Animate + + + + + + + Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a + Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution + in the context of the current user. Exploitation of this issue requires user interaction + in that a victim must open a malicious file. (CVE-2023-22236) + Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a + Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution + in the context of the current user. Exploitation of this issue requires user interaction + in that a victim must open a malicious file. (CVE-2023-22243) + Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a + Use After Free vulnerability that could result in arbitrary code execution in the + context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-22246) + + + + + Glenn Lugod + + DRAFT + + DRAFT + 5.10 + + + + + + + + + + + + + diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_9469.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_9469.xml new file mode 100644 index 000000000000..a248cbb921e2 --- /dev/null +++ b/repository/definitions/vulnerability/oval_org.cisecurity_def_9469.xml @@ -0,0 +1,71 @@ + + + Multiple vulnerabilities on Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 + (and earlier) + + Microsoft Windows 8 + Microsoft Windows 8.1 + Microsoft Windows 10 + Microsoft Windows 11 + Microsoft Windows Server 2012 + Microsoft Windows Server 2012 R2 + Microsoft Windows Server 2016 + Microsoft Windows Server 2019 + Adobe Bridge + + + + + + + + + + + Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an + out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An + attacker could leverage this vulnerability to bypass mitigations such as ASLR. + Exploitation of this issue requires user interaction in that a victim must open a + malicious file. (CVE-2023-21583) + Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by a + Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution + in the context of the current user. Exploitation of this issue requires user interaction + in that a victim must open a malicious file. (CVE-2023-22226) + Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an + out-of-bounds write vulnerability that could result in arbitrary code execution in the + context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-22227) + Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an + Improper Input Validation vulnerability that could result in arbitrary code execution in + the context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-22228) + Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an + out-of-bounds write vulnerability that could result in arbitrary code execution in the + context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-22229) + Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an + out-of-bounds write vulnerability that could result in arbitrary code execution in the + context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-22230) + Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an + out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An + attacker could leverage this vulnerability to bypass mitigations such as ASLR. + Exploitation of this issue requires user interaction in that a victim must open a + malicious file. (CVE-2023-22231) + + + + + Glenn Lugod + + DRAFT + + DRAFT + 5.10 + + + + + + + diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_9470.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_9470.xml new file mode 100644 index 000000000000..9f4bfdef6a4f --- /dev/null +++ b/repository/definitions/vulnerability/oval_org.cisecurity_def_9470.xml @@ -0,0 +1,49 @@ + + + Adobe InDesign versions ID18.1 (and earlier) and ID17.4 (and earlier) are affected by + a NULL Pointer Dereference vulnerability. (CVE-2023-21593) + + Microsoft Windows 7 + Microsoft Windows 8 + Microsoft Windows 8.1 + Microsoft Windows 10 + Microsoft Windows 11 + Microsoft Windows Server 2003 + Microsoft Windows Server 2008 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2012 + Microsoft Windows Server 2012 R2 + Adobe InDesign + + + + + Adobe InDesign versions ID18.1 (and earlier) and ID17.4 (and earlier) are affected by a + NULL Pointer Dereference vulnerability. + An unauthenticated attacker could leverage this vulnerability to achieve an application + denial-of-service in the context of the current user. + Exploitation of this issue requires user interaction in that a victim must open a + malicious file. (CVE-2023-21593) + + + + + Glenn Lugod + + DRAFT + + DRAFT + 5.10 + + + + + + + + + + + + + diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_9471.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_9471.xml new file mode 100644 index 000000000000..c3fa8094e1f8 --- /dev/null +++ b/repository/definitions/vulnerability/oval_org.cisecurity_def_9471.xml @@ -0,0 +1,69 @@ + + + Multiple vulnerabilites on Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) + + Microsoft Windows 8 + Microsoft Windows 8.1 + Microsoft Windows 10 + Microsoft Windows 11 + Microsoft Windows Server 2012 + Microsoft Windows Server 2012 R2 + Microsoft Windows Server 2016 + Microsoft Windows Server 2019 + Adobe Photoshop + + + + + + + + + Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper + Input Validation vulnerability that could result in arbitrary code execution in the + context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-21574) + Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an + out-of-bounds write vulnerability that could result in arbitrary code execution in the + context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-21575) + Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an + out-of-bounds write vulnerability that could result in arbitrary code execution in the + context of the current user. Exploitation of this issue requires user interaction in + that a victim must open a malicious file. (CVE-2023-21576) + Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an + out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An + attacker could leverage this vulnerability to bypass mitigations such as ASLR. + Exploitation of this issue requires user interaction in that a victim must open a + malicious file. (CVE-2023-21577) + Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an + out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An + attacker could leverage this vulnerability to bypass mitigations such as ASLR. + Exploitation of this issue requires user interaction in that a victim must open a + malicious file. (CVE-2023-21578) + + + + + Glenn Lugod + + DRAFT + + DRAFT + 5.10 + + + + + + + + + + + + + + + + diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_9472.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_9472.xml new file mode 100644 index 000000000000..1569019588f9 --- /dev/null +++ b/repository/definitions/vulnerability/oval_org.cisecurity_def_9472.xml @@ -0,0 +1,46 @@ + + + + Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow + vulnerability. (CVE-2019-7095) + + + Microsoft Windows 2000 + Microsoft Windows XP + Microsoft Windows Server 2003 + Microsoft Windows Vista + Microsoft Windows Server 2008 + Microsoft Windows Server 2008 R2 + Microsoft Windows 7 + Microsoft Windows 8 + Microsoft Windows 8.1 + Microsoft Windows 10 + Microsoft Windows Server 2012 + Microsoft Windows Server 2012 R2 + Microsoft Windows Server 2016 + Microsoft Windows Server 2019 + Adobe Digital Editions + + + + + Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow + vulnerability. Successful exploitation could lead to arbitrary code execution. + (CVE-2019-7095) + + + + + Glenn Lugod + + DRAFT + + DRAFT + 5.10 + + + + + + + diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1526.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1526.xml deleted file mode 100644 index b7681ac446e9..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1526.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 14.0.2 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1528.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1528.xml deleted file mode 100644 index 1d00f31d8a1e..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1528.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 13.1.1 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1534.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1534.xml deleted file mode 100644 index 95de2564f62b..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1534.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 12.0.4 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1537.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1537.xml deleted file mode 100644 index ea06ade6b4a4..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1537.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 23.5 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1539.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1539.xml deleted file mode 100644 index 13a45a8935c0..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1539.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 23.5.4 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1541.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1541.xml deleted file mode 100644 index 03c77a471958..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1541.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 24.1 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1543.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1543.xml deleted file mode 100644 index f13436ae6dff..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1543.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 24.1.1 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1546.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1546.xml deleted file mode 100644 index c6d896364202..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1546.xml +++ /dev/null @@ -1,4 +0,0 @@ - - ID18.2 - \ No newline at end of file diff --git a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1548.xml b/repository/states/windows/file_state/1000/oval_com.gfi_ste_1548.xml deleted file mode 100644 index 1d638177c8a0..000000000000 --- a/repository/states/windows/file_state/1000/oval_com.gfi_ste_1548.xml +++ /dev/null @@ -1,4 +0,0 @@ - - ID17.4.1 - \ No newline at end of file diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25376.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25376.xml new file mode 100644 index 000000000000..9900bfbbcad4 --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25376.xml @@ -0,0 +1,3 @@ + + 24.1.1 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25378.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25378.xml new file mode 100644 index 000000000000..cd9f0670c84f --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25378.xml @@ -0,0 +1,3 @@ + + 23.5.4 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25379.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25379.xml new file mode 100644 index 000000000000..051ef159cd4a --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25379.xml @@ -0,0 +1,3 @@ + + 13.1.1 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25380.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25380.xml new file mode 100644 index 000000000000..04075c6374a3 --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25380.xml @@ -0,0 +1,3 @@ + + 24.1 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25381.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25381.xml new file mode 100644 index 000000000000..f0f15ce9394e --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25381.xml @@ -0,0 +1,3 @@ + + ID17.4.1 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25383.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25383.xml new file mode 100644 index 000000000000..f54ef53fe185 --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25383.xml @@ -0,0 +1,3 @@ + + 12.0.4 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25384.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25384.xml new file mode 100644 index 000000000000..da63d4ef11d4 --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25384.xml @@ -0,0 +1,3 @@ + + 23.5 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25385.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25385.xml new file mode 100644 index 000000000000..ba76bdeb093e --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25385.xml @@ -0,0 +1,3 @@ + + ID18.2 + diff --git a/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25386.xml b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25386.xml new file mode 100644 index 000000000000..d59965f1c740 --- /dev/null +++ b/repository/states/windows/file_state/25000/oval_org.cisecurity_ste_25386.xml @@ -0,0 +1,3 @@ + + 14.0.2 + diff --git a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1523.xml b/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1523.xml deleted file mode 100644 index 3d11cf1179a1..000000000000 --- a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1523.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 13.1 - \ No newline at end of file diff --git a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1531.xml b/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1531.xml deleted file mode 100644 index 1c0063ab46a8..000000000000 --- a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1531.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 4.5.10.186048 - \ No newline at end of file diff --git a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1551.xml b/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1551.xml deleted file mode 100644 index 42219e471b82..000000000000 --- a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1551.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 22.0.9 - \ No newline at end of file diff --git a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1553.xml b/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1553.xml deleted file mode 100644 index 5c276aa2588b..000000000000 --- a/repository/states/windows/registry_state/1000/oval_com.gfi_ste_1553.xml +++ /dev/null @@ -1,4 +0,0 @@ - - 23.0.1 - \ No newline at end of file diff --git a/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25374.xml b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25374.xml new file mode 100644 index 000000000000..5cacb4b67d41 --- /dev/null +++ b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25374.xml @@ -0,0 +1,3 @@ + + 4.5.10.186048 + diff --git a/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25375.xml b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25375.xml new file mode 100644 index 000000000000..e17796b4a18a --- /dev/null +++ b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25375.xml @@ -0,0 +1,3 @@ + + 23.0.1 + diff --git a/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25377.xml b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25377.xml new file mode 100644 index 000000000000..397c4def1b5e --- /dev/null +++ b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25377.xml @@ -0,0 +1,3 @@ + + 22.0.9 + diff --git a/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25382.xml b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25382.xml new file mode 100644 index 000000000000..5f601729bd69 --- /dev/null +++ b/repository/states/windows/registry_state/25000/oval_org.cisecurity_ste_25382.xml @@ -0,0 +1,3 @@ + + 13.1 + diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1525.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1525.xml deleted file mode 100644 index 7a670b4ccbac..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1525.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1527.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1527.xml deleted file mode 100644 index ca6b6edae1ce..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1527.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1533.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1533.xml deleted file mode 100644 index 8479c4f22be2..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1533.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1536.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1536.xml deleted file mode 100644 index 4224f230b803..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1536.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1538.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1538.xml deleted file mode 100644 index b4e879b2a234..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1538.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1540.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1540.xml deleted file mode 100644 index c4431f3c4e2c..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1540.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1542.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1542.xml deleted file mode 100644 index 6f912013b5a9..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1542.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1545.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1545.xml deleted file mode 100644 index de45b62583c2..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1545.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1547.xml b/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1547.xml deleted file mode 100644 index 9da04368e25f..000000000000 --- a/repository/tests/windows/file_test/1000/oval_com.gfi_tst_1547.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141480.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141480.xml new file mode 100644 index 000000000000..04fa3c1d9e79 --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141480.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141481.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141481.xml new file mode 100644 index 000000000000..d22788085686 --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141481.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141483.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141483.xml new file mode 100644 index 000000000000..7d17cc2ce35a --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141483.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141484.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141484.xml new file mode 100644 index 000000000000..93117dda8ded --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141484.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141485.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141485.xml new file mode 100644 index 000000000000..82861bee1eb2 --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141485.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141486.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141486.xml new file mode 100644 index 000000000000..fc75f55565c3 --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141486.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141489.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141489.xml new file mode 100644 index 000000000000..9ffbaf8f1c43 --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141489.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141490.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141490.xml new file mode 100644 index 000000000000..14c8cda3749f --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141490.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141492.xml b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141492.xml new file mode 100644 index 000000000000..29fb3b6b2c57 --- /dev/null +++ b/repository/tests/windows/file_test/141000/oval_org.cisecurity_tst_141492.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1522.xml b/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1522.xml deleted file mode 100644 index dd851a1f0e58..000000000000 --- a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1522.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1530.xml b/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1530.xml deleted file mode 100644 index 828e09a30fc4..000000000000 --- a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1530.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1550.xml b/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1550.xml deleted file mode 100644 index ac68bc3202a9..000000000000 --- a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1550.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1552.xml b/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1552.xml deleted file mode 100644 index cbb17277d0b8..000000000000 --- a/repository/tests/windows/registry_test/1000/oval_com.gfi_tst_1552.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - \ No newline at end of file diff --git a/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141482.xml b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141482.xml new file mode 100644 index 000000000000..bad5e9390ad1 --- /dev/null +++ b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141482.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141487.xml b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141487.xml new file mode 100644 index 000000000000..80fd78e7c009 --- /dev/null +++ b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141487.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141488.xml b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141488.xml new file mode 100644 index 000000000000..32a1719355d6 --- /dev/null +++ b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141488.xml @@ -0,0 +1,4 @@ + + + + diff --git a/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141491.xml b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141491.xml new file mode 100644 index 000000000000..c02c195dc2b9 --- /dev/null +++ b/repository/tests/windows/registry_test/141000/oval_org.cisecurity_tst_141491.xml @@ -0,0 +1,4 @@ + + + +