Cory Duplantis

An information disclosure issue exists due to the way the driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver, potentially resulting in sensitive information disclosure from the kernel. The IN instruction can read four bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.

An information disclosure issue exists due to the way the driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver, potentially resulting in sensitive information disclosure from the kernel. The IN instruction can read data from the given I/O device, potentially leaking sensitive device data to unprivileged users.

An information disclosure issue exists in the way the driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver, resulting in sensitive information disclosure from the kernel. The `IN` instruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.

An information disclosure issue exists in the handling of IOCTL 0x9c40a148. A specially crafted I/O request packet (IRP) can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this issue.

A privilege escalation issue exists in the handling of IOCTL 0x9c406144. This can be triggered by a specially crafted I/O request packet (IRP), leading to increased privileges. An attacker can exploit this by sending a malicious IRP.

A privilege escalation issue exists in the way the driver handles Privileged I/O write requests. During the IOCTL 0x9c40a0e0 operation, the first dword passed in the input buffer specifies the device port to write to, and the dword at offset 4 is the value to write via the OUT instruction. A local attacker can send a malicious IRP to trigger this issue.

A privilege escalation issue exists due to the way the driver handles Privileged I/O write requests. Specifically, during the `IOCTL 0x9c40a0dc` operation, the first dword in the input buffer specifies the device port to write to, and the word at offset 4 is the value to write via the `OUT` instruction. This allows writing one byte to the given I/O device port, potentially leading to escalated privileges for unprivileged users. A local attacker can exploit this by sending a malicious IRP.

A privilege escalation issue exists in the way the driver handles Privileged I/O write requests. During the `IOCTL 0x9c40a0d8` operation, the first dword passed in the input buffer specifies the device port to write to, and the byte at offset 4 is the value to write via the `OUT` instruction. This `OUT` instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users.

Name of the Vulnerable Software and Affected Versions: Intel Raid Web Console 3 Description: The issue is caused by insufficient input validation, which may allow a remote attacker to cause a denial of service. Recommendations: For Intel Raid Web Console 3, consider restricting network access to the console as a temporary workaround until a patch is available.

A heap out of bounds write issue exists in the UI tag parsing functionality of the DICOM image format. This can be triggered by a specially crafted DICOM image, potentially allowing code execution. An attacker can exploit this by crafting a DICOM image to cause an offset beyond the bounds of a heap allocation to be written.

An integer overflow vulnerability exists in the BMP header parsing functionality. A specially crafted BMP image file can cause an integer overflow, potentially resulting in code execution. An attacker can specially craft a BMP image to trigger this issue.

The issue is related to a Use After Free vulnerability in the CharProcs parsing functionality. It can be triggered by a specially crafted PDF, causing a type confusion that results in a Use After Free. An attacker can exploit this by crafting a malicious PDF.

A Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free. An attacker can send a malicious PDF to trigger this issue.

A code execution issue exists in the XPM image rendering function. A specially crafted XPM image can cause an integer overflow in the `colorhash` function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this issue.

The issue is related to an error in the window function of the SQLite database management system. Exploitation of this issue can allow a remote attacker to cause a denial of service. A specially crafted SQL command can trigger a use after free vulnerability, potentially resulting in remote code execution. The problem is caused by an error in the implementation of window functions, starting from the SQLite 3.26 branch.

A buffer overflow issue exists in the LoadEncoding functionality. This can be triggered by a specially crafted R script, causing a buffer overflow that results in memory corruption. An attacker can exploit this by sending a malicious R script.

A buffer overflow in Redis causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the `client-output-buffer-limit` option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.