CVE-2019-7107 Code injection in InDesign
Unsafe hyperlink processing in Adobe InDesign allows attackers to execute arbitrary code via malicious documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7107?
CVE-2019-7107 is a critical code injection vulnerability in Adobe Indesign, published on 23 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing vulnerability. Successful exploitation could lead to arbitrary code execution. Fixed in versions 13.1.1 and 14.0.2.
Which versions are affected by CVE-2019-7107?
It affects 1 product.
Products include Adobe Indesign.
How do I fix CVE-2019-7107?
No fix has been published for CVE-2019-7107 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-7107 being exploited?
There is no known exploitation of CVE-2019-7107 in the wild and no public exploit code.
Other vulnerabilities in Adobe Indesign
- CVE-2017-11302 Memory corruption in Adobe InDesign 12.1.0 and earlier versions
- CVE-2016-7886 Memory corruption in Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier
- CVE-2021-36004 Adobe InDesign CoolType out of bounds write vulnerability could lead to arbitrary stack manipulation
- CVE-2021-21098 Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code execution
- CVE-2021-21099 Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code execution
Sources
Also known as GHSA-27r8-6jpp-p76v.