ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash.

Windows Print Spooler Components Denial of Service Vulnerability

Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to deny service over a network.

Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protections. Refer to the '  Security Update for ASUS System Control Interface  ' section on the ASUS Security Advisory for more information.

Untrusted Pointer Dereference in ASUS GPU Tweak and AI Suite Leading to Local Privilege Escalation

Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation. Refer to the '  Security Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin   ' section on the ASUS Security Advisory for more information.

Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability

Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack.

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.

Windows ALPC Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally.

Pointer Dereference in Samsung Exynos 1580 Camera Driver Causes Limited Information Disclosure and Denial of Service

An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed message is sent to the camera driver, causing limited information disclosure or denial of service.

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0(r4) l.lwz r27,0(r5) l.sw 0(r4),r27 l.sw 0(r5),r29 The pointers are not checked with access_ok(). The four memory accesses also have no exception table entries. A caller passes a kernel address as either pointer, and the syscall reads from and writes to it directly. This gives an unprivileged process a kernel read/write primitive. It overwrites kernel data such as the sys_call_table, gaining code execution in kernel context. Check both pointers before entering the critical section. Add fixups for the four memory accesses so faults on valid but unmapped user addresses return -EFAULT. [shorne@gmail.com: fix comment style]

Microsoft Failover Cluster Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

Windows Hyper-V Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute code locally.

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

Microsoft Office PowerPoint Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Microsoft Office PowerPoint Information Disclosure Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Memory Corruption Vulnerability in Samsung Open Source mTower

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.

Untrusted Pointer Dereference in Samsung mTower Enables Memory Manipulation

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer.