Adobe and VMWare pushed out a critical out-of-band updates for After Effects and vRealize Operations for Horizon Adapter which if exploited could lead to arbitrary code execution.

The Adobe
issue, CVE-2020-3765, is an out-of-bounds write vulnerability affecting After
Effects version 16.1.2 and earlier versions for Windows. Adobe is recommending
that Admin’s update to version 17.0.3 through its Creative Cloud desktop app’s
update mechanism.

This comes one week after Adobe’s usual Patch Tuesday offering on February 12 that impacted Flash Player, Framemaker, Reader and Reader DC, Digital Edition and Experience Manager.

VMWare’s update covered
the critical CVE-2020-3943, CVE-2020-3944 and CVE-2020-3945. The fix for all
three flaws has been posted.

CVE-2020-3943 covers a
JMX RMI service which is not securely configured that could allow
unauthenticated remote attacker who has network access to vRealize Operations,
with the Horizon Adapter running to execute code.

CVE-2020-3944 handles an
improper trust store configuration leading to authentication bypass which could
let An unauthenticated remote attacker with network access to vRealize
Operations, with the Horizon Adapter running, to bypass Adapter authentication.

CVE-2020-3945 is an
information disclosure vulnerability due to incorrect pairing implementation
between the vRealize Operations for Horizon Adapter and Horizon View. As with
the previous two vulnerabilities an unauthenticated person with access to vRealize
Operations, with the Horizon Adapter running may obtain data which then can be
used to bypass the adapter authentication mechanism.