Grigoritchy

The issue is related to a flaw in the Netfilter subsystem of the Linux kernel, specifically in the xt u32 module, which does not validate fields in the xt u32 structure. This allows a local privileged attacker to trigger an out-of-bounds read by setting size fields beyond array boundaries, potentially leading to a crash or information disclosure. The flaw is associated with the `u32 match it` function and involves reading data beyond buffer boundaries in memory.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.1.3 Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the WinAppHelper component, resulting from the lack of proper access control. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.1.3, at the moment, there is no information about a newer version that contains a fix for this issue.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Parallels Tools component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel on the target guest system.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Parallels Tools component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel on the target guest system.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the prl hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this issue to escalate privileges and execute code in the context of the hypervisor.

This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target guest system. The flaw exists within the VGA virtual device due to the lack of proper validation of user-supplied data, resulting in a read past the end of an allocated array. This can be leveraged in conjunction with other issues to escalate privileges and execute code in the context of the hypervisor.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the hypervisor kernel extension. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this issue to escalate privileges and execute code in the context of the hypervisor.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the `prl hypervisor` module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this issue to escalate privileges and execute code in the context of the kernel.

This issue allows local attackers to disclose information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the `prl hypervisor` kext due to the lack of proper validation of user-supplied data, resulting in a read past the end of an allocated buffer. This can be leveraged in conjunction with other issues to execute arbitrary code in the context of the kernel.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the prl hypervisor kext due to the lack of proper validation of user-supplied data, resulting in a write past the end of an allocated buffer. This can be leveraged to escalate privileges and execute code in the context of the kernel.

This issue allows local attackers to disclose information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the IOCTL handler, resulting from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of the kernel.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the IOCTL handler, resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this issue to escalate privileges and execute code in the context of the kernel.

A memory corruption issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. The issue is related to a WebKit display module vulnerability, which is associated with a buffer overflow in memory. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code.