Nicholas Zubrisky

A stack-based buffer overflow in the spamBlocker (spamd) service allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory.

An issue exists in the SAML single sign-on session handling (samld) where untrusted data is deserialized. An attacker who has already obtained the ability to write files on the appliance can execute arbitrary code within the context of the `samld` service by inducing the service to load a maliciously crafted session file. Deserialization is the process of converting a data format, such as a file or network stream, back into an object that can be used by a program.

The issue relates to a race condition within the `Preauh HashValue()` function of the ksmbd component in the Linux kernel. This occurs when a client sends multiple session setup requests to ksmbd. The problem stems from incorrect synchronization when a shared resource is used. The vulnerability could allow an attacker to cause a denial of service. The vulnerable function is `Preauh HashValue()`. The `sess->Preauh HashValue` variable is involved in the race condition.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A null pointer dereference error in the `generate encryptionkey` function within the ksmbd module could occur if a client sends two session setups with Kerberos v5 authentication to ksmbd. The `Preauth HashValue` is set to NULL if the session is valid, leading to the error. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A null pointer dereference error occurs in the Linux kernel when a client sets the `PreviousSessionId` during the Kerberos session setup stage. This happens because `sess->user` is not set yet, allowing a null value to be passed to `destroy previous session()`. The issue is resolved by moving the call to `destroy previous session()` after `ksmbd krb5 authenticate()`, where `sess->user` is set. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The vulnerable software is 7-Zip, a widely used file compression utility. The issue arises from an integer underflow in the Zstandard decompression implementation, allowing remote attackers to execute arbitrary code on affected installations of 7-Zip by crafting specially designed archive files. To exploit this issue, interaction with the 7-Zip library is required, but attack vectors may vary depending on the implementation. The problem stems from the lack of proper validation of user-supplied data, leading to an integer underflow before writing to memory, which an attacker can leverage to execute code in the context of the current process. The vulnerable versions of 7-Zip are those prior to version 24.07. Users are advised to update to version 24.07 or later to mitigate this risk. An exploit for this issue has been reported and demonstrated, highlighting the severity of the problem. #7Zip #RemoteCodeExecution #Cybersecurity #Zstandard #IntegerUnderflow #CodeExecution #Security #UpdateNow

The issue is related to a lack of access control in the Windows Update Stack component, which can be exploited to elevate privileges. An attacker must first obtain the ability to execute low-privileged code on the target system. This can allow an attacker to impact the system.

This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.

Name of the Vulnerable Software and Affected Versions: PaperCut NG/MF versions (affected versions not specified) Description: The issue is related to an arbitrary file deletion vulnerability in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. This vulnerability can be exploited by an attacker who obtains local login access to the Windows Server hosting PaperCut NG/MF and can execute low-privilege code directly on the server via the web-print-hot-folder. The risk is mitigated in most installations by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. Recommendations: As a temporary workaround, consider restricting access to the `web-print-hot-folder` to minimize the risk of exploitation. Restrict local login access to Administrators only on the Windows Server hosting PaperCut NG/MF. Avoid allowing non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

This issue allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the PSANHost executable, where an attacker can create a junction and abuse the service to create arbitrary files, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations. The flaw exists within the VPN process, which does not restrict DLL search to trusted paths, allowing the loading of a malicious DLL. An attacker can leverage this to escalate privileges and execute arbitrary code in the context of SYSTEM. The attacker must first obtain the ability to execute low-privileged code on the target system.

This issue allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the AVG Service, where an attacker can create a symbolic link to abuse the service and delete a file, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the PSANHost service. By creating a junction, an attacker can abuse the service to create an arbitrary file, which can be leveraged to escalate privileges and execute arbitrary code in the context of SYSTEM.

This issue allows local attackers to create a denial-of-service condition on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Avast Service, where an attacker can abuse the service to create a folder by creating a symbolic link, leading to a denial-of-service condition on the system.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the Hydra Sdk Windows Service due to improper permissions set on a folder created by the service, allowing an attacker to escalate privileges and execute arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the AVG Service, where an attacker can create a symbolic link to abuse the service and delete a folder, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to create a denial-of-service condition on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue. The specific flaw exists within the AVG Installer, where an attacker can abuse the update functionality to create a file by creating a symbolic link. This can be leveraged to create a persistent denial-of-service condition on the system.

This issue allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Anti Malware Service, where an attacker can abuse the service to delete a file by creating a symbolic link. This can be leveraged to escalate privileges and execute arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Avast Service, where an attacker can create a symbolic link to abuse the service and delete a file, potentially escalating privileges and executing arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse the service to delete a folder. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of SYSTEM.