Dong-Uk Kim

The NVIDIA Installer for NvAPP for Windows has a flaw in the FrameviewSDK installation process. An attacker with local unprivileged access can alter files within the Frameview SDK directory. A successful exploit could result in privilege escalation.

A local user can gain SYSTEM privileges through insecure file delete operations within the cleaning feature on Windows.

An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file delete operations during the update process.

An issue exists in the Oracle Java SE Install component that allows a low-privileged attacker with logon access to the infrastructure where Oracle Java SE executes to compromise the software. Successful attacks require human interaction from a person other than the attacker and can result in a takeover of Oracle Java SE. This applies to the installation process on client deployments of Java.

The issue concerns the behavior of `os.OpenFile` when the target path is a dangling symlink. On Unix systems, `os.OpenFile` with `O CREATE` and `O EXCL` flags never follows symlinks. However, on Windows, if the target path was a symlink to a nonexistent location, `os.OpenFile` would create a file in that location. This discrepancy has been addressed, and now `os.OpenFile` always returns an error when the `O CREATE` and `O EXCL` flags are both set and the target path is a symlink.

The update mechanism in Mozilla Firefox allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, enabling SYSTEM-level file operations on paths controlled by a non-privileged user and allowing privilege escalation.