premiere

In December 2024, Adobe released 16 patches addressing 167 CVEs across various products, including Adobe Experience Manager, Acrobat and Reader, Media Encoder, Illustrator, After Effects, Animate, InDesign, Adobe PDFL SDK, Connect, Substance 3D Sampler, Photoshop, Substance 3D Modeler, Bridge, Premiere Pro, Substance 3D Painter, and FrameMaker. The most significant patch resolved 91 CVEs in Adobe Experience Manager, primarily related to cross-site scripting (XSS) and one critical code execution vulnerability. Other notable patches included 22 CVEs for Connect, several code execution vulnerabilities for Acrobat, and 13 critical-rated code execution bugs for Animate. Additional patches addressed 9 CVEs each for InDesign and Substance 3D Modeler, 4 CVEs for Media Encoder, 3 CVEs for Substance 3D Sampler, and 2 CVEs each for Illustrator and Substance 3D Painter. None of the vulnerabilities were publicly known or under active attack at the time of release. Microsoft's December release included 71 new CVEs affecting Windows and its components, Office, SharePoint Server, Hyper-V, Defender for Endpoint, and System Center Operations Manager, totaling 72 CVEs for the month, the largest since 2017. Among the patches, 16 were rated Critical, 54 Important, and one Moderate. Notably, CVE-2024-49138 is actively being exploited, while CVE-2024-49112 allows remote code execution via LDAP with a CVSS score of 9.8. CVE-2024-49117 permits code execution from a guest VM on Hyper-V, and CVE-2024-49063 involves deserialization vulnerabilities in the Muzic project. Organizations are advised to patch promptly to mitigate risks.