Software maker Adobe on Tuesday released security fixes for at least a half dozen vulnerabilities that expose Windows and macOS users to malicious hacker attacks.

The Mountain View, Calif. company warned that the security problems exist on three of its most popular software products — Photoshop, Illustrator and After Effects.

According to Adobe’s security bulletins, the Illustrator and After Effects patches carry critical-severity ratings because of the risk of code execution attacks.

The company said the Adobe Illustrator vulnerability, tracked as CVE-2022-23187, is a buffer overflow issue that leads to arbitrary code execution. The bug is present for both Windows and macOS users on Illustrator 26.0.3 and earlier versions.

A second critical bulletin was released to cover at least four documented Adobe After Effects vulnerabilities that expose Windows and macOS users to code execution attacks.

“This update addresses critical security vulnerabilities.  Successful exploitation could lead to arbitrary code execution in the context of the current user,” Adobe said in a bulletin that documents stack-based buffer overflows with serious implications.

Adobe tracks the After Effects bugs as CVE-2022-24094, CVE-2022-24095, CVE-2022-24096, and CVE-2022-24097.

The company also shipped a third bulletin to cover an important-severity flaw in its flagship Adobe Photoshop software.

The Photoshop vulnerability (CVE-2022-24090) affects both Windows and macOS users and Adobe warns that successful exploitation could lead to memory leak in the context of the current user.   

Adobe said it was not aware of any exploits in the wild for any of the flaws patched this month.

Adobe’s patches follow the release of patches from Apple to cover an already exploited WebKit zero-day affecting its iOS, iPadOS and macOS platforms.

The WebKit flaw, tracked as CVE-2023-23529, is described as a type confusion issue that can be exploited for arbitrary code execution by getting the targeted user to access a malicious website.

Virtualization technology giant VMware on Tuesday shipped its first security bulletin for 2023 with patches for multiple critical-level flaws that expose businesses to remote code execution attacks.

VMware said the security defects affect users of its VMware vRealize Log Insight and could be exploited by an unauthenticated attacker to take full control of a target system.

VMware’s VRealize Log Insight is a log collection and analytics virtual appliance used by administrators to collect, view, manage and analyze syslog data.

The company said the most serious of the four documented flaws carry a CVSS severity score of 9.8 out of 10, adding to the urgency for organizations to apply available patches.

An advisory from the Palo Alto, Calif. company described the flaws — CVE-2022-31706, CVE-2022-31704, CVE-2022-31710 and CVE-2022-31711 –as directory traversal and broken access control issues with dangerous implications.

“An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution,” VMware warned.

The company also shipped fixes for a separate deserialization vulnerability that exposes vRealize Log Insight users to denial-of-service attacks.

VMware also patched an information disclosure issue that allowed attackers to remotely collect sensitive session and application information without authentication.

Oracle today released the April 2022 Critical Patch Update.

This Critical Patch Update provides security updates for a wide range of product families, including: Oracle Database Server, Oracle Autonomous Health Framework, Oracle Blockchain Platform, Oracle GoldenGate, Oracle REST Data Services, Oracle Commerce, Oracle Communications Applications, Oracle Communications, Oracle Construction and Engineering, Oracle E-Business Suite, Oracle Enterprise Manager, Oracle Financial Services Applications, Oracle Fusion Middleware, Oracle Health Sciences Applications, Oracle HealthCare Applications, Oracle Hospitality Applications, Oracle Hyperion, Oracle iLearning, Oracle Insurance Applications, Oracle Java SE, Oracle JD Edwards, Oracle MySQL, Oracle PeopleSoft, Oracle Retail Applications, Oracle Supply Chain, Oracle Support Tools, Oracle Systems, Oracle Taleo, Oracle Utilities Applications, Oracle Virtualization.

With this Critical Patch Update release, Oracle is making a small adjustment to the Critical Patch Update release schedule.  Critical Patch Updates will no longer be released on the Tuesday closest to the 17th of the month of January, April, July, and October, but they will be released on the third Tuesday of January, April, July, and October.   This minor adjustment will not affect the frequency of Critical Patch Update releases (still 4 times a year), but essentially, makes it easier to set calendar reminders and determine the date of future Critical Patch Update releases.

For more information about the April 2022 Critical Patch Update, customers should refer to the Critical Patch Update Advisory located at https://oracle.com/security-alerts/cpuapr2022.html and the executive summary published on My Oracle Support (Doc ID 2857016.1).

For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on Oracle’s corporate security practices site.