Polar Bear

The issue is caused by synchronization errors when using a shared resource in the Windows Lightweight Directory Access Protocol (LDAP) implementation. This allows a remote attacker to execute arbitrary code.

The issue is related to incorrect clearing or release of resources in the Windows CryptoAPI, which can be exploited by a remote attacker to cause a denial of service.

The issue exists due to insufficient input validation in the Windows Secure Channel component of the Windows operating system. This can be exploited by a remote attacker to cause a denial of service.

The issue exists due to insufficient input validation in the Windows Secure Channel component of the Windows operating system. This can be exploited by a remote attacker to cause a denial of service.

The issue exists due to insufficient input validation in the Windows Secure Channel component of the Windows operating system. Exploitation of this issue may allow a remote attacker to cause a denial of service.

The issue arises when an X.509 certificate contains a malformed policy constraint and policy processing is enabled. This results in a write lock being taken twice recursively, leading to a denial of service when the affected process hangs on some operating systems, most notably Windows. Policy processing is enabled by passing the `-policy` argument to the command line utilities or by calling the `X509 VERIFY PARAM set1 policies()` function. It is worth noting that policy processing being enabled on a publicly facing server is not considered a common setup.

The issue is related to insufficient input validation in the implementation of the Kerberos protocol in Windows operating systems. This can be exploited by a remote attacker to cause a denial of service.

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. This occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack, potentially resulting in a crash or remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

The issue is related to insufficient input validation in the Windows Secure Channel component of the Microsoft Windows operating system. Exploitation of this issue may allow a remote attacker to cause a denial of service by sending specially crafted data to the TLS server. This can affect the system, potentially leading to a denial of service.

The issue exists due to insufficient input validation in the Windows Secure Channel. It allows a remote attacker to cause a denial of service.

The issue is related to insufficient input validation in the HTTP.sys driver of the Windows operating system. It can be exploited by a remote attacker using a specially crafted request to cause a denial of service.

The issue exists due to insufficient input validation in the Windows Secure Channel component of the Windows operating system. Exploitation of this issue may allow a remote attacker to cause a denial of service.

The issue is related to the incorrect management of code generation in the Windows IKE protocol extension, which can be exploited by a remote attacker to execute arbitrary code. This allows the attacker to potentially affect the system.

The issue is related to the incorrect clearing or release of resources in the Windows IKE extension, which can lead to a denial-of-service condition. This can be exploited by a remote attacker to cause a service disruption.

The issue is related to the incorrect clearing or release of resources in the Windows IKE extension, which can lead to a denial-of-service condition. This can be exploited by a remote attacker to cause a service disruption.

A remote code execution issue exists, and a denial-of-service vulnerability allows attackers to affect the system.

The issue is related to incorrect resource cleanup or release. It may allow a remote attacker to cause a denial of service.

The issue is related to incorrect clearing or release of resources in the Windows IKE extension, which can be exploited by a remote attacker to cause a denial of service. This can affect the system, allowing attackers to impact its operation.

The issue is related to a denial-of-service vulnerability in the implementation of the TCP/IP protocol in Microsoft Windows, caused by insufficient input validation. This can be exploited by a remote attacker to cause a denial of service by sending specially crafted input to the application.

The issue is related to insufficient access restrictions in the Windows Installer component, allowing an attacker to potentially elevate their privileges. This could affect the system, but specific details about the number of potentially affected devices or real-world incidents are not provided.