Muhammad Alifa Ramdhan

A security issue exists that allows attackers to affect the system.

A security issue exists that allows attackers to affect the system.

A security issue exists that allows attackers to affect the system.

A Use-After-Free issue in the mobile processor leads to privilege escalation.

An issue was discovered in the mobile processor, where a Use-After-Free leads to privilege escalation.

An issue was discovered in the mobile processor, where a Double Free leads to privilege escalation.

An issue was discovered in Samsung Mobile Processor Exynos, where a Double Free in the mobile processor leads to privilege escalation.

An issue was discovered in the Samsung Mobile Processor Exynos, where the lack of a length check leads to out-of-bounds writes.

An issue was discovered in the Samsung Mobile Processor Exynos, where the lack of a length check leads to out-of-bounds writes.

A Use-After-Free issue in the mobile processor leads to privilege escalation.

An issue was discovered in Samsung Mobile Processor Exynos, where the absence of a NULL check leads to a Denial of Service.

A Double Free issue in the mobile processor can lead to privilege escalation. This issue affects Samsung Mobile Processor Exynos models 1280, 1380, 1480, 2200, and 2400.

An issue was discovered in the Samsung Mobile Processor Exynos 1380, where the lack of a length check leads to out-of-bounds writes.

A Use-After-Free issue in the mobile processor can lead to privilege escalation.

The issue is related to the lack of a length check, which leads to out-of-bounds writes. This problem was discovered in the Samsung Mobile Processor Exynos.

A Use-After-Free issue in the mobile processor leads to privilege escalation.

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.29.0 Description: The issue is related to insufficient restriction of the communication channel for given endpoints, allowing an attacker who has gained access to the Docker Desktop VM through a container breakout to further escape to the host by passing extensions and dashboard related IPC messages. Exploitation requires the "Allow only extensions distributed through the Docker Marketplace" setting to be disabled. Recommendations: For Docker Desktop versions prior to 4.29.0, update to version 4.29.0 or later to fix the issue on MacOS, Linux, and Windows with Hyper-V backend. Additionally, consider enabling the "Allow only extensions distributed through the Docker Marketplace" setting by default, as introduced in Docker Desktop version 4.31.0, to prevent exploitation. As a temporary workaround, consider disabling the extension-manager until a patch is available. Restrict access to the vulnerable IPC messages to minimize the risk of exploitation.

The issue allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox. The vulnerability exists due to insufficient input validation.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.1.3 Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.1.3, consider disabling the Toolgate component until a patch is available. Restrict access to the Toolgate component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the `lsi do msgout` function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.