M4Rkw

Name of the Vulnerable Software and Affected Versions: Arq versions 5.10 and earlier Description: The issue allows local users to gain root privileges by writing to arbitrary files via a crafted restore path using the standardrestorer binary. Recommendations: For Arq versions 5.10 and earlier, consider restricting access to the standardrestorer binary until a patch is available. As a temporary workaround, avoid using the standardrestorer binary for restoring paths that could potentially be crafted to gain elevated privileges.

Name of the Vulnerable Software and Affected Versions: Arq versions 5.10 and earlier Description: The issue allows local users to gain root privileges by writing to arbitrary files via a crafted update URL. This can be achieved by using a malicious URL, such as `file:///tmp/blah/Arq.zip`, to exploit the `arq updater` binary. Recommendations: For Arq versions 5.10 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Arq versions 5.x before 5.10 **Description** The issue allows local users to gain root privileges via a crafted data packet, affecting several helper apps in Arq, including arq updater, arqcommitter, standardrestorer, arqglacierrestorer, and arqs3glacierrestorer. **Recommendations** For Arq versions 5.x before 5.10, update to version 5.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Arq versions prior to 5.9.7 **Description** The issue allows local users to gain root privileges via a symlink attack on the updater binary itself, specifically targeting the `setpermissions` function in the auto-updater. **Recommendations** For versions prior to 5.9.7, update to version 5.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the auto-updater to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HashiCorp Vagrant VMware Fusion plugin versions 5.0.1 **Description** A local attacker or malware can silently subvert the plugin update process to escalate to root privileges. **Recommendations** For HashiCorp Vagrant VMware Fusion plugin version 5.0.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HashiCorp Vagrant VMware Fusion plugin version 5.0.0 **Description** A local attacker or malware can silently subvert the plugin update process to escalate to root privileges. **Recommendations** For HashiCorp Vagrant VMware Fusion plugin version 5.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) versions 4.0.24 and earlier **Description** The issue is related to an insecure suid wrapper binary, which allows a non-root user to obtain a root shell. **Recommendations** For HashiCorp Vagrant VMware Fusion plugin versions 4.0.24 and earlier, update to a version later than 4.0.24 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Proxifier for Mac versions prior to 2.19 **Description** The issue allows local users to gain privileges. This is achieved via the first parameter to the `KLoader` setuid program. **Recommendations** For versions prior to 2.19, update to version 2.19 or later to resolve the issue.