CVE-2021-43030

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-43030
Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose arbitrary data on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:adobe:premiere_rush:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

02 Feb 2022, 13:04

Type Values Removed Values Added
CVSS v2 : 4.3
v3 : 5.5 		v2 : 4.3
v3 : 3.3

28 Jan 2022, 22:15

Type Values Removed Values Added
Summary Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it. Adobe Premiere Rush versions 1.5.16 (and earlier) allows access to an uninitialized pointer vulnerability that allows remote attackers to disclose arbitrary data on affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files. The issue results from the lack of proper initialization of memory prior to accessing it.
References
  • {'url': 'https://www.zerodayinitiative.com/advisories/ZDI-21-1587/', 'name': 'https://www.zerodayinitiative.com/advisories/ZDI-21-1587/', 'tags': ['Third Party Advisory', 'VDB Entry'], 'refsource': 'MISC'}

04 Jan 2022, 16:39

Type Values Removed Values Added
References (MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1587/ - (MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1587/ - Third Party Advisory, VDB Entry

21 Dec 2021, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 3.3 		v2 : 4.3
v3 : 5.5
CPE cpe:2.3:a:adobe:premiere_rush:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
References
  • (MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1587/ -
References (MISC) https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html - (MISC) https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html - Vendor Advisory

20 Dec 2021, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-20 21:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-43030

Mitre link : CVE-2021-43030

CVE.ORG link : CVE-2021-43030

JSON object : View

Products Affected

microsoft

  • windows

adobe

  • premiere_rush
CWE
CWE-824

Access of Uninitialized Pointer