Vlad Stolyarov

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 11.6 iOS versions prior to 18.6 iPadOS versions prior to 18.6 tvOS versions prior to 18.6 macOS Sequoia versions prior to 15.6 visionOS versions prior to 2.6 **Description** The software contains multiple memory corruption issues due to inadequate input validation. Processing a maliciously crafted texture may cause unexpected application termination. **Recommendations** Update watchOS to version 11.6 or later. Update iOS to version 18.6 or later. Update iPadOS to version 18.6 or later. Update tvOS to version 18.6 or later. Update macOS Sequoia to version 15.6 or later. Update visionOS to version 2.6 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 138.0.7204.157 Microsoft Edge versions prior to 138.0.3351.95 Opera versions prior to 120.0.5543.93 Opera GX versions prior to 120.0.5543.85 Opera Air versions prior to 120.0.5543.86 Apple Safari (via WebKit) versions prior to iOS 18.6 and macOS Sequoia 15.6 **Description** A high-severity vulnerability exists in the ANGLE and GPU components of Google Chrome and Chromium-based browsers. This flaw involves improper validation of untrusted input, potentially allowing a remote attacker to escape the browser's sandbox via a crafted HTML page. This could lead to remote code execution. The vulnerability is actively being exploited in the wild. Apple's Safari, which utilizes the WebKit engine, is also affected. **Recommendations** - Update Google Chrome to version 138.0.7204.157 or later. - Update Microsoft Edge to version 138.0.3351.95 or later. - Update Opera to version 120.0.5543.93 or later. - Update Opera GX to version 120.0.5543.85 or later. - Update Opera Air to version 120.0.5543.86 or later. - Update Apple iOS to version 18.6 or later. - Update Apple macOS to Sequoia 15.6 or later.

**Name of the Vulnerable Software and Affected Versions** SQLite versions prior to 3.50.2 **Description** An issue exists where the number of aggregate terms in a query can exceed the number of available columns, leading to integer truncation. This flaw can result in memory corruption, potentially causing the system to crash (denial of service) or allowing an attacker to execute arbitrary code. Real-world exploitation has been observed in Siemens RUGGEDCOM CROSSBOW SAC, where the issue was used to achieve privilege escalation and lateral movement within networked industrial systems. Additionally, the vulnerability affects the `WinSqlite3.dll` component in Windows environments. **Recommendations** Update to version 3.50.2 or above. As a temporary workaround, consider bundling updated SQLite libraries to replace vulnerable versions of `WinSqlite3.dll`.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** A null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Subsystem for Linux (affected versions not specified) Description: The issue is related to an untrusted pointer dereference, which allows an unauthorized attacker to execute code locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Task Scheduler versions prior to the fixed version in November Patch Tuesday **Description** The vulnerability is an elevation-of-privilege issue in the Windows Task Scheduler, allowing attackers to elevate their privileges to Medium Integrity level and gain the ability to execute RPC functions restricted to privileged accounts. This vulnerability has been exploited in the wild, with the RomCom group executing malicious code outside the Firefox sandbox and launching malware from C&C servers. The attack can be performed from an AppContainer restricted environment. **Recommendations** To resolve the issue, apply the patch released in November Patch Tuesday for Windows Task Scheduler. As a temporary workaround, consider restricting access to the Task Scheduler until a patch is applied. Avoid using the Task Scheduler to execute RPC functions that are restricted to privileged accounts until the issue is resolved. Apply the latest security updates to prevent exploitation of this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows DWM Core Library (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Windows DWM Core Library. This vulnerability allows attackers to affect the system. It has been linked to cyberattacks involving QakBot, a notorious banking trojan. The vulnerability is being actively exploited by QakBot and other malware. Researchers have identified a new zero-day vulnerability in Windows, designated as this issue, and it is being used by multiple attackers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to insufficient input validation in the drm/amdgpu component of the Linux kernel. This can lead to a denial of service. The vulnerability is associated with the functions `amdgpu vm bo insert map()`, `amdgpu vm bo map()`, `amdgpu vm bo replace map()`, and `amdgpu vm bo clear mappings()` in the file drivers/gpu/drm/amd/amdgpu/amdgpu vm.c. The parameters of `amdgpu vm bo (map/replace map/clearing mappings)` are not validated clearly, which can be exploited to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to April 2024 Patch Tuesday **Description** This issue is a security feature bypass vulnerability affecting the SmartScreen Prompt Security Feature in Microsoft Windows. The vulnerability allows attackers to bypass SmartScreen, potentially delivering malicious software to a target system. Exploitation requires user interaction, such as opening a specially crafted file or clicking a malicious link. Reports indicate that this vulnerability is being actively exploited in the wild, and it is related to CVE-2024-21412, which has been exploited by the Water Hydra APT group. The vulnerability impacts the security of web page shortcut prompts. **Recommendations** Apply the updates released during the April 2024 Patch Tuesday to address this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the February 2024 patch update are affected, including Windows 10 and Windows 11. **Description** The vulnerability is related to Internet Shortcut Files and allows attackers to bypass Microsoft Defender SmartScreen, enabling them to execute arbitrary code on affected systems. This issue has been exploited by the Water Hydra APT group, targeting financial traders. The attackers use specially crafted files to bypass security warnings, leading to the installation of malware such as DarkMe. Phishing emails are a common threat vector used in these attacks. **Recommendations** To resolve the issue, apply the February 2024 patch update or later to your Microsoft Windows system. Ensure that your Windows operating system is up-to-date to protect against this vulnerability. As a temporary workaround, consider restricting access to Internet Shortcut Files and avoiding the use of suspicious links or files from untrusted sources until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 120.0.6099.129 **Description** A heap buffer overflow in WebRTC allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability is actively exploited and may cause crashes or code execution. The issue is due to a heap buffer overflow weakness in the open-source WebRTC framework. **Recommendations** For Google Chrome versions prior to 120.0.6099.129, update to version 120.0.6099.129 or later to fix the heap buffer overflow vulnerability in WebRTC. As a temporary workaround, consider disabling WebRTC until a patch is available. Restrict access to WebRTC to minimize the risk of exploitation. Avoid using vulnerable WebRTC functions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Error Reporting Service (affected versions not specified) **Description** The issue is related to an elevation-of-privilege vulnerability in the Windows Error Reporting Service, which allows attackers to affect the system. This vulnerability is associated with insecure privilege management and can be exploited to gain administrator privileges on a Windows device. There have been reports of this vulnerability being exploited in the wild. The Falcon Complete MDR team has discovered and blocked a zero-day exploit affecting Windows Error Reporting. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office and Windows versions (affected versions not specified) **Description** This issue is a remote code execution vulnerability affecting Microsoft Office and Windows systems. It stems from flaws in how input data is processed, specifically related to Office and Windows HTML. Successful exploitation allows attackers to execute arbitrary code remotely, potentially impacting the system. The vulnerability has been actively exploited in the wild by threat actors, including the RomCom (Storm-0978) group, who have used it to deploy Underground Ransomware. The vulnerability allows attackers to bypass Mark of the Web (MOTW) defenses. The exploitation involves a complex chain, potentially utilizing .search-ms files and CHM files. The vulnerability was initially identified as CVE-2023-36884 and has been exploited in targeted attacks against organizations in Europe and North America. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to a security feature bypass vulnerability in Microsoft Windows SmartScreen. This vulnerability can be exploited by an attacker to bypass security restrictions by loading specially crafted malicious files. The vulnerability is associated with errors in security settings. There have been real-world incidents where this issue was exploited, including its use by Magniber ransomware actors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.