Nicholas Zubrisky

A stack-based buffer overflow in the spamBlocker (spamd) service allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory.

An issue exists in the SAML single sign-on session handling (samld) where untrusted data is deserialized. An attacker who has already obtained the ability to write files on the appliance can execute arbitrary code within the context of the `samld` service by inducing the service to load a maliciously crafted session file. Deserialization is the process of converting a data format, such as a file or network stream, back into an object that can be used by a program.

تتعلق المشكلة بحالة تنافس داخل الدالة `Preauh HashValue()` في مكون ksmbd بنواة لينكس. يحدث هذا عندما يرسل عميل عدة طلبات لإنشاء جلسة عمل إلى ksmbd. تنشأ المشكلة عن تزامن غير صحيح عند استخدام مورد مشترك. قد تسمح هذه الثغرة الأمنية لمهاجم بإحداث حالة رفض الخدمة. الدالة المعرضة للخطر هي `Preauh HashValue()`. المتغير `sess->Preauh HashValue` متورط في حالة التنافس.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: نواة لينكس (الإصدارات المتأثرة غير محددة) الوصف: قد يحدث خطأ في الإشارة إلى مؤشر فارغ في الدالة `generate encryptionkey` داخل الوحدة النمطية ksmbd إذا أرسل عميل إعدادين للجلسة باستخدام مصادقة Kerberos v5 إلى ksmbd. يتم تعيين `Preauth HashValue` على NULL إذا كانت الجلسة صالحة، مما يؤدي إلى حدوث الخطأ. التوصيات: في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: نواة لينكس (الإصدارات المتأثرة غير محددة) الوصف: يحدث خطأ في الإشارة إلى مؤشر فارغ في نواة لينكس عندما يقوم عميل بتعيين `PreviousSessionId` أثناء مرحلة تكوين جلسة كيربيروس. ويحدث ذلك لأن `sess->user` لم يتم تعريفه بعد، مما يسمح بتمرير قيمة فارغة إلى `destroy previous session()`. يتم حل المشكلة عن طريق نقل استدعاء `destroy previous session()` إلى ما بعد `ksmbd krb5 authenticate()`، حيث يتم تعريف `sess->user`. التوصيات: في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

The vulnerable software is 7-Zip, a widely used file compression utility. The issue arises from an integer underflow in the Zstandard decompression implementation, allowing remote attackers to execute arbitrary code on affected installations of 7-Zip by crafting specially designed archive files. To exploit this issue, interaction with the 7-Zip library is required, but attack vectors may vary depending on the implementation. The problem stems from the lack of proper validation of user-supplied data, leading to an integer underflow before writing to memory, which an attacker can leverage to execute code in the context of the current process. The vulnerable versions of 7-Zip are those prior to version 24.07. Users are advised to update to version 24.07 or later to mitigate this risk. An exploit for this issue has been reported and demonstrated, highlighting the severity of the problem. #7Zip #RemoteCodeExecution #Cybersecurity #Zstandard #IntegerUnderflow #CodeExecution #Security #UpdateNow

The issue is related to a lack of access control in the Windows Update Stack component, which can be exploited to elevate privileges. An attacker must first obtain the ability to execute low-privileged code on the target system. This can allow an attacker to impact the system.

This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.

Name of the Vulnerable Software and Affected Versions: PaperCut NG/MF versions (affected versions not specified) Description: The issue is related to an arbitrary file deletion vulnerability in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. This vulnerability can be exploited by an attacker who obtains local login access to the Windows Server hosting PaperCut NG/MF and can execute low-privilege code directly on the server via the web-print-hot-folder. The risk is mitigated in most installations by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. Recommendations: As a temporary workaround, consider restricting access to the `web-print-hot-folder` to minimize the risk of exploitation. Restrict local login access to Administrators only on the Windows Server hosting PaperCut NG/MF. Avoid allowing non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

This issue allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the PSANHost executable, where an attacker can create a junction and abuse the service to create arbitrary files, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations. The flaw exists within the VPN process, which does not restrict DLL search to trusted paths, allowing the loading of a malicious DLL. An attacker can leverage this to escalate privileges and execute arbitrary code in the context of SYSTEM. The attacker must first obtain the ability to execute low-privileged code on the target system.

This issue allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the AVG Service, where an attacker can create a symbolic link to abuse the service and delete a file, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the PSANHost service. By creating a junction, an attacker can abuse the service to create an arbitrary file, which can be leveraged to escalate privileges and execute arbitrary code in the context of SYSTEM.

This issue allows local attackers to create a denial-of-service condition on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Avast Service, where an attacker can abuse the service to create a folder by creating a symbolic link, leading to a denial-of-service condition on the system.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Hydra Sdk Windows Service due to improper permissions set on a folder created by the service, allowing an attacker to escalate privileges and execute arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the AVG Service, where an attacker can create a symbolic link to abuse the service and delete a folder, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to create a denial-of-service condition on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue. The specific flaw exists within the AVG Installer, where an attacker can abuse the update functionality to create a file by creating a symbolic link. This can be leveraged to create a persistent denial-of-service condition on the system.

This issue allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Anti Malware Service, where an attacker can abuse the service to delete a file by creating a symbolic link. This can be leveraged to escalate privileges and execute arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Avast Service, where an attacker can create a symbolic link to abuse the service and delete a file, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse the service to delete a folder. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of SYSTEM.