Jack Dates

Name of the Vulnerable Software and Affected Versions: Sonos Era 300 (affected versions not specified) Description: This issue allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. The specific flaw exists within the processing of HLS playlist data, resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An unauthenticated remote attacker can disrupt the charging functionality by causing a denial-of-service (DoS) in the control agent due to access of an uninitialized pointer.

An unauthenticated remote attacker can cause a denial of service (DoS) to the control agent due to an out-of-bounds read, which may prevent or disrupt the charging functionality. The issue is related to the HomePlug Protocol.

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 (affected versions not specified) Description: The issue is related to an incomplete cleanup during service restart after a Denial of Service (DoS), allowing an unauthenticated remote attacker to gain service level privileges. This can also lead to remote code execution due to a use-after-free vulnerability in the ClientSession. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A buffer overflow issue was addressed with improved bounds checking, which may allow a malicious application to execute arbitrary code with kernel privileges.

A buffer overflow issue was addressed with improved bounds checking, which may allow an application to execute arbitrary code with kernel privileges.

The issue involves multiple out-of-bounds write problems that have been resolved through enhanced bounds checking. A malicious application could potentially execute arbitrary code with kernel privileges.

The issue involves multiple out-of-bounds write problems that have been resolved through enhanced bounds checking. A malicious application could potentially execute arbitrary code with kernel privileges.

A race condition was addressed with improved state handling, which could allow a malicious application to execute arbitrary code with kernel privileges.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.1.3 Description: This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other issues to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.1.3, at the moment, there is no information about a newer version that contains a fix for this issue.

The issue is related to multiple memory corruption problems that have been addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using malicious web content.

A malicious application may be able to execute arbitrary code with kernel privileges due to an out-of-bounds write issue. This issue was addressed with improved bounds checking.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Big Sur 11.3 Security Update versions prior to 2021-002 Catalina Description: A malicious application may be able to execute arbitrary code with kernel privileges due to an out-of-bounds write issue. This issue was addressed with improved bounds checking. Recommendations: For macOS versions prior to Big Sur 11.3, update to macOS Big Sur 11.3 or later to resolve the issue. For versions that require Security Update, apply Security Update 2021-002 Catalina or later to fix the problem.