PT-2019-14044

Name of the Vulnerable Software and Affected Versions Valve Steam Client for Windows versions prior to 2019-08-16 Description The issue allows local users to escalate privileges to NT AUTHORITYSYSTEM. This is possible because local users can replace the current versions of SteamService.exe and...

CVE-2019-15316: Time-of-check Time-of-use (TOCTOU) Race Condition

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation to NT AUTHORITY\SYSTEM via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition...

PT-2019-14045

Name of the Vulnerable Software and Affected Versions Valve Steam Client for Windows versions through 2019-08-20 Description The issue is related to weak folder permissions, which can lead to privilege escalation to NT AUTHORITYSYSTEM. This can be achieved through crafted use of...

CVE-2019-15315: Incorrect Permission Assignment for Critical Resource

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation to NT AUTHORITY\SYSTEM because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch...

CVE-2019-14743: Incorrect Permission Assignment for Critical Resource

In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access...

PT-2019-13811

Name of the Vulnerable Software and Affected Versions Valve Steam Client for Windows versions prior to 2019-08-07 Description The issue allows local users to gain NT AUTHORITYSYSTEM access due to explicit "Full control" for the Users group in the HKLMSOFTWAREWow6432NodeValveSteam registry key...