Adrian Denkiewicz

A heap-based buffer overflow occurs in the Windows Virtualization-Based Security (VBS) Enclave. This issue allows an authorized attacker to elevate privileges locally on the system. A heap-based buffer overflow is a memory corruption error that happens when a program writes more data to a heap-allocated memory block than it can hold.

An untrusted pointer dereference in the Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. This issue enables attackers to affect the system by gaining higher-level permissions.

A path traversal issue in the `ReadMultiple` internode storage-REST endpoint allows an attacker with the cluster root JWT to read files outside the configured drive roots. This affects distributed-erasure (multi-node) deployments, while single-node standalone deployments are not affected. The attack requires an HS512 JWT signed with `MINIO ROOT PASSWORD` and the `accessKey` set to `MINIO ROOT USER`. The issue occurs because the `ReadMultiple` handler in `cmd/storage-rest-server.go` forwards the `Bucket`, `Prefix`, and `Files` fields from a msgpack-encoded `ReadMultipleReq` body to `xlStorage.ReadMultiple` in `cmd/xl-storage.go` without validation. The `pathJoin` function resolves `..` components, allowing access to any path on the filesystem accessible by the MinIO process UID. An attacker can trigger this by sending a POST request to '/minio/storage/{drivePath}/v63/rmpl' with traversal sequences in the `Bucket` field. Impact varies by deployment: on bare-metal systems, access is limited to files owned by the MinIO UID (e.g., TLS private keys, KMS/KES key material); in containerized environments running as UID 0, it allows arbitrary host-filesystem disclosure, including `/etc/shadow` and Kubernetes service-account tokens.

The issue is related to insufficient protection of service data in the Windows Installer component of Windows operating systems. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information. It is a vulnerability that enables attackers to obtain sensitive information and affect the system.

The issue exists due to insufficient input validation in the Windows Installer. Exploitation of this issue may allow an attacker to elevate their privileges. An elevation-of-privilege vulnerability allows attackers to affect the system.

Name of the Vulnerable Software and Affected Versions: Windows Installer (affected versions not specified) Description: The issue is related to errors in privilege management within the Windows Installer component of Microsoft Windows operating systems. This can allow an attacker to elevate their privileges. An elevation-of-privilege vulnerability exists, enabling attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A local privilege escalation issue exists due to improper access control in the GalaxyClientService installed by GOG Galaxy, allowing an attacker to send unauthenticated local TCP packets and gain SYSTEM privileges on a Windows system with GOG Galaxy installed.