Adobe Responds to Vendor Response Blog Post
Summary: Adobe's Brad Arkin corrected a researcher's JBIG2 timeline, stating Adobe learned of the bug on January 16, 2009 and issued the first patch for version 9 on Mac and Windows on March 10, 2009, and said later investments let Adobe ship three zero-day patches in about two weeks each in April, July, and October. The researcher, Matt, accepted the date corrections but questioned Adobe's decision to hold the December patch to the scheduled January 12, 2010 quarterly update, citing an informal poll of large organizations that favored aligning with their schedules.
What you should know: Adobe's own account puts its first JBIG2 fix roughly seven weeks after it learned of the bug, and its later zero-day turnarounds at about two weeks - the gap a security leader is exposed to while waiting for a vendor patch, especially for organizations without the infrastructure to run mitigations like JavaScript blocklisting.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026