N0Psledbyte

A heap-based buffer overflow flaw was found in the way the legacy parse param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged local user able to open a filesystem that does not support the Filesystem Context API could use this flaw to escalate their privileges on the system. The vulnerability allows a local attacker to cause a denial of service or execute arbitrary code. It can also be used to escape Kubernetes containers.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.1.3 Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.1.3, consider disabling the Toolgate component until a patch is available. Restrict access to the Toolgate component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the `lsi do msgout` function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.

The issue is related to a flaw in the APIs component of Oracle Installed Base, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, including creation, deletion, or modification of data. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to a buffer read operation that can lead to unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. It affects the Core component of Oracle VM VirtualBox and can be exploited by a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes. Successful attacks may significantly impact additional products.

The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products.