Second Adobe Photoshop flaw disclosed in a week

A hacker with the handle Marsu posted both exploits to the Milw0rm website.

The most recently discovered vulnerability exists in Photoshop versions CS2 and CS3 and Photoshop Elements version 5. The flaw is caused by a boundary error within the PNG.8BI Photoshop Format Plugin when handling PNG files, according to a Secunia advisory.

The flaw was ranked "highly critical" by Secunia.

The vulnerability can be exploited to cause a stack-based buffer overflow via a malicious PNG file.

Secunia recommended users avoid untrusted PNG files, adding that the flaw can be exploited to run arbitrary code.

An Adobe spokesman said today that the company is "investigating the issue to determine the extent of the threat and if any actions are required."

The Photoshop flaw released last week is caused by the improper processing of bitmap files and can lead to a stack-based buffer overflow. The earlier bug resides in Photoshop CS2 and CS3, and was ranked as "highly critical," by Secunia.

Marsu referenced the earlier flaw on the Milw0rm website, saying, "like bitmap files, PNG files can do great things."

The hacker claimed his exploit also works on Corel Paint Shop Pro 11.20 and is tested on Windows XP Service Pack 2.

adobedisclosedflawinphotoshopsecondsecurityweek