Ezrak1E

يسمح إلغاء مرجع المؤشر الفارغ (Null pointer dereference) في Microsoft QUIC لمهاجم غير مصرح له بالتسبب في حجب الخدمة عبر الشبكة. يحدث إلغاء مرجع المؤشر الفارغ عندما يحاول برنامج القراءة من أو الكتابة في عنوان ذاكرة فارغ، مما يؤدي عادةً إلى تعطل التطبيق.

يسمح مسار بحث غير موثوق به في واجهة برمجة تطبيقات الوصول عن بعد لنظام Windows (Windows Remote Access API) للمهاجم المصرح له برفع الامتيازات محليًا، مما قد يؤدي إلى اختراق النظام بالكامل.

يسمح إلغاء مرجع مؤشر غير موثوق به في Windows Core Messaging لمهاجم مصرح له برفع الامتيازات محليًا، مما قد يؤدي إلى اختراق النظام بالكامل.

A heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially leading to memory corruption.

A use-after-free (UAF) vulnerability was found in the `vmw cmd res check` function in drivers/gpu/vmxgfx/vmxgfx execbuf.c. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service (DoS). The vulnerability is related to the device file `/dev/dri/renderD128 (or Dxxx)`.

An integer overflow vulnerability was found in the vmwgfx driver in the GPU component of the Linux kernel. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service (DoS). The vulnerability is related to the device file '/dev/dri/renderD128 (or Dxxx)' and the file 'vmxgfx execbuf.c' in the 'drivers/gpu/vmxgfx' directory.

A use-after-free (UAF) vulnerability was found in the `vmw execbuf tie context` function in the Linux kernel's vmwgfx driver. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service (DoS). The vulnerability is related to the device file `/dev/dri/renderD128 (or Dxxx)`.

A NULL pointer dereference vulnerability was found in the vmwgfx driver in the GPU component of the Linux kernel. This issue is related to errors in pointer dereferencing and can be exploited by a local attacker with a user account on the system to gain privileges or cause a denial of service. The vulnerability is associated with the device file '/dev/dri/renderD128 (or Dxxx)'.

A memory access vulnerability outside the limits (OOB) has been found in the vmwgfx driver in the Linux kernel, specifically in the drivers/gpu/vmxgfx/vmxgfx kms.c file. This issue is related to a buffer overflow in memory and can be exploited by a local attacker with a user account on the system to gain privileges, resulting in a denial of service (DoS). The vulnerability is associated with the device file "/dev/dri/renderD128 (or Dxxx)".

This issue allows local attackers to delete arbitrary files on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component, resulting from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to delete arbitrary files in the context of the hypervisor.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the hypervisor.

This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component, resulting from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other issues to escalate privileges and execute arbitrary code in the context of the hypervisor.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component, resulting from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to escalate privileges and execute code in the context of the current user on the host system.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.0.1-48919 Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system. The flaw exists within the Toolgate component due to the lack of proper validation of user-supplied data, resulting in an integer overflow before allocating a buffer. This can be leveraged to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.0.1-48919, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.0.1-48919 Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system. The flaw exists within the Toolgate component due to the lack of proper validation of user-supplied data, resulting in an integer overflow before allocating a buffer. This can be leveraged to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.0.1-48919, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.0.1-48919 Description: This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system. The flaw exists within the Toolgate component due to the lack of proper validation of user-supplied data, resulting in a read past the end of an allocated buffer. This can be leveraged in conjunction with other issues to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.0.1-48919, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.0.1-48919 Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this issue to escalate privileges and execute code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.0.1-48919, consider disabling the Toolgate component as a temporary workaround until a patch is available. Restrict access to the Toolgate component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.