CVE-2020-9677: 
NixOS vulnerability analysis and mitigation

Adobe Prelude versions 9.0 and earlier were found to contain an out-of-bounds read vulnerability identified as CVE-2020-9677. The vulnerability was discovered and reported to Adobe on April 9, 2020, and was publicly disclosed on July 22, 2020. This security flaw specifically affects the processing of 3GP files in Adobe Prelude, a video asset management application that works with Premiere Pro (ZDI Advisory, Threatpost).

The vulnerability is classified as an out-of-bounds read issue that occurs during the processing of 3GP files. The specific flaw exists due to the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, ZDI assigned it a CVSS score of 7.8 with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, ZDI Advisory).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current process. The flaw requires user interaction to be exploited, specifically requiring the target to visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction for exploitation, where the target must visit a malicious page or open a malicious file. At the time of disclosure, Adobe stated that there were no known exploits of this vulnerability in the wild (Threatpost).

Adobe addressed this vulnerability by releasing version 9.0.1 of Prelude. Users of affected versions (9.0 and earlier) are advised to update to the patched version (Threatpost).