Kim Dong-Uk

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 128.0.6613.84 Microsoft Edge (versões afetadas não especificadas) **Descrição** O problema está relacionado à validação insuficiente de dados no componente Installer, permitindo que um invasor local realize escalonamento de privilégios por meio de um arquivo malicioso. Isso pode levar a um invasor obter privilégios mais elevados no sistema. **Recomendações** Para versões do Google Chrome anteriores à 128.0.6613.84, atualize para a versão 128.0.6613.84 ou posterior para resolver o problema. Para o Microsoft Edge, no momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Visio (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Visio, which is part of Microsoft Office and 365 Apps for Enterprise. This can allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Visio (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Visio, a part of Microsoft Office and 365 Apps for Enterprise. This can allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Visio (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft Office. Exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions prior to the January 9, 2024 security update Office 2019 Office 2021 Office LTSC for Mac 2021 Microsoft 365 **Description** A security issue exists in FBX that could lead to remote code execution. The vulnerability is related to errors in processing input data, which can be exploited by opening a specially crafted malicious file. To mitigate this issue, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint, and Outlook for Windows and Mac. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. **Recommendations** For Office 2019, disable the ability to insert FBX files. For Office 2021, disable the ability to insert FBX files. For Office LTSC for Mac 2021, disable the ability to insert FBX files. For Microsoft 365, disable the ability to insert FBX files. As a temporary workaround, consider avoiding the use of FBX files in Office applications until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Media Player (affected versions not specified) **Description** The issue is related to insufficient input validation in Windows Media Player, which can be exploited by an attacker to execute arbitrary code using a specially crafted file. This allows remote attackers to execute arbitrary code and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.