Andrew Hess

Name of the Vulnerable Software and Affected Versions: Intel(R) Iris(R) Xe MAX Dedicated Graphics Drivers for Windows 10 versions prior to 27.20.100.9466 Description: The issue is related to improper access control in the installer for some Intel(R) Iris(R) Xe MAX Dedicated Graphics Drivers for Windows 10, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions prior to 27.20.100.9466, update to version 27.20.100.9466 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Citrix Workspace App versions prior to 1912 **Description** The issue allows local users to gain privileges during the uninstallation of the application due to Insecure Permissions and an Unquoted Path vulnerability. **Recommendations** For versions prior to 1912, update to version 1912 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Citrix Workspace App versions prior to 1912 **Description** The issue is related to Insecure Permissions, which allows local users to gain privileges during the uninstallation of the application. **Recommendations** For versions prior to 1912, update to version 1912 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to inadequate access control in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized creation, deletion, or modification of critical data or all accessible data in Oracle VM VirtualBox. This vulnerability may also impact additional products. **Recommendations** For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Intel(R) PROSet/Wireless WiFi products versions prior to 21.70 **Description** The issue is related to improper buffer restrictions in the kernel mode driver, which may allow an unprivileged user to potentially enable denial of service via adjacent access. This could be exploited by a remote attacker to cause a denial of service. The vulnerability is associated with out-of-bounds write and stack-based buffer overflow, allowing remote code execution. **Recommendations** For versions prior to 21.70, update to version 21.70 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable driver until a patch is applied. Avoid using the driver for critical operations until the issue is resolved. At the moment, there is no additional information about other mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Intel Driver and Support Assistant versions prior to 20.1.5 **Description** The issue is caused by a race condition error when using a shared resource, potentially allowing an attacker to cause a denial of service. This can be exploited by an authenticated user via local access. **Recommendations** For versions prior to 20.1.5, update to version 20.1.5 or later to resolve the issue. As a temporary workaround, consider restricting local access to the Intel Driver and Support Assistant until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** OpenVPN Connect version 3.1.0.361 **Description** The issue concerns insecure permissions for the directory `%PROGRAMDATA%OpenVPN Connectdriverstapamd64win10`. This allows local users to gain privileges by copying a malicious `drvstore.dll` to this location. **Recommendations** For OpenVPN Connect version 3.1.0.361, consider restricting access to the `%PROGRAMDATA%OpenVPN Connectdriverstapamd64win10` directory to prevent local users from copying malicious files, such as `drvstore.dll`, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) PROSet/Wireless WiFi products on Windows 10 (affected versions not specified) **Description** The issue is related to an out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10, which may allow an authenticated user to potentially enable denial of service via local access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kramer VIAware version 2.5.0719.1034 **Description** The issue is related to Incorrect Access Control. **Recommendations** For version 2.5.0719.1034, update to a newer version that addresses the Incorrect Access Control issue.