Alexander Hagenah

A use after free issue in Windows Autopilot allows an authorized attacker to elevate privileges locally. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed, which can lead to arbitrary code execution or privilege escalation.

Missing authentication for a critical function in the Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally to SYSTEM. Low-privileged code with access to the Windows diagnostics workflow can trigger a trusted Event Tracing for Windows (ETW) event containing an attacker-controlled Lua module path. The `whesvc` service can then execute that module through WinDiag without properly validating the producer or restricting the module location.

Name of the Vulnerable Software and Affected Versions: BitDefender Engine versions 1.6.1 and earlier Description: The issue allows remote attackers to bypass virus scanning by including begin and end commands in the body of an e-mail, which is treated as a uuencoded attachment, causing the scan to stop afterwards. Recommendations: For BitDefender Engine versions 1.6.1 and earlier, update to a version later than 1.6.1 to resolve the issue.