CVE-2023-24904 Windows Installer Elevation of Privilege Vulnerability

...

CVE-2023-24904

Technical details about CVE-2023-24904 are not publicly available in the provided connected documents. Monitor for updates from official advisories and vendor bulletins for affected components, impact, and remediation.

Operation ChattyGoblin: Hackers Targeting Gambling Firms via Chat Apps

A gambling company in the Philippines was the target of a China-aligned threat actor as part of a campaign that has been ongoing since October 2021. Slovak cybersecurity firm ESET is tracking the series of attacks against Southeast Asian gambling companies under the name Operation ChattyGoblin...

QEMU: local privilege escalation via the QEMU Guest Agent on Windows

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system...

End of support for Office 2013

End of support for Office 2013 Support for Office 2013 ended on April 11, 2023 and there will be no extension and no extended security updates. All of your Office 2013 apps will continue to function. However, you could expose yourself to serious and potentially harmful security risks.Buy or try...

Description of the security update for Excel 2013: May 9, 2023 (KB5002384)

Description of the security update for Excel 2013: May 9, 2023 KB5002384 Summary This security update resolves a Microsoft Excel remote code execution vulnerability. To learn more about the vulnerability, see ​​Microsoft Common Vulnerabilities and Exposures CVE-2023-24953. Note: To apply this...

Windows Installer Elevation of Privilege Vulnerability

...

PT-2023-2695 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to errors in memory object handling mechanisms in the Windows Installer component of Windows operating systems. This can allow an attacker to elevate their...

Microsoft Windows Installer 安全漏洞

Microsoft Windows Installer is a component of the Windows operating system from Microsoft. It provides a standard basis for installing and uninstalling software. A security vulnerability exists in Microsoft Windows Installer. Windows Server 2008 for x64-based Systems Service Pack 2,Windows Server...

Intel® oneAPI Toolkit and Component Software Installers Advisory

Summary: A potential security vulnerability in some Intel® oneAPI Toolkit and component software installers may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-22355 Description: Uncontrolled searc...

Fedora: Security Advisory for rust-coreos-installer (FEDORA-2023-cc21019773)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: rust-coreos-installer-0.17.0-3.fc38

coreos-installer installs Fedora CoreOS or RHEL CoreOS to bare-metal machines or, occasionally, to virtual machines...

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry

An advanced persistent threat APT actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism. "The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an...

F5 BIG-IP Edge Client Windows Component Installer < 7.2.4.1 MITM (K000132522)

The version of the Big-IP Edge Client Windows Component Installer installed on the remote Windows host is before 7.2.4.1. In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows. An unauthenticated attacker with a...

May 2, 2023, update for Office 2013 (KB5002297)

May 2, 2023, update for Office 2013 KB5002297 This article describes update 5002297 for Microsoft Office 2013 that was released on May 2, 2023. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer...

May 2, 2023, update for PowerPoint 2013 (KB4504725)

May 2, 2023, update for PowerPoint 2013 KB4504725 This article describes update 4504725 for Microsoft PowerPoint 2013 that was released on May 2, 2023. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft...

Chinese Hackers Using MgBot Malware to Target International NGOs in Mainland China

The advanced persistent threat APT group referred to as Evasive Panda has been observed targeting an international non-governmental organization NGO in Mainland China with malware delivered via update channels of legitimate applications like Tencent QQ. The attack chains are designed to distribut...

CVE-2023-21099

In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21081

In multiple functions of PackageInstallerService.java and related files, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2022-34755

A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a...