Jan Vojtěšek

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the February 2024 Patch Tuesday update Windows 10 version 10.0.17763.5458 and earlier Windows 11 and Windows Server 2022 and Windows Server 2019 (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Windows Kernel, caused by insufficient access control in IOCTL commands. This allows attackers to escalate privileges. The vulnerability was exploited by the Lazarus Group as a zero-day, enabling the bypass of security measures like Windows Defender. The flaw was found in the appid.sys Windows AppLocker driver. **Recommendations** Apply the February 2024 Patch Tuesday updates to fix the vulnerability in Microsoft Windows AppLocker. Update Windows 10 to version 10.0.17763.5459 or later. Update Windows 11 and Windows Server 2022 and Windows Server 2019 to the latest version. As a temporary workaround, consider disabling the appid.sys driver until a patch is available. Restrict access to the appid.sys driver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an elevation-of-privilege vulnerability in the Win32k component of Windows operating systems. This vulnerability is associated with errors in processing objects in memory. Exploitation of this vulnerability can allow an attacker to elevate their privileges. The vulnerability can be exploited by opening a specially crafted RTF file, which can lead to local privilege escalation (LPE) to system level. There have been reports of this vulnerability being actively exploited in the wild. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows versions prior to the fixed version **Description** The issue is related to a buffer overflow in the Windows Advanced Local Procedure Call (ALPC) handler, which can be exploited to elevate privileges and execute arbitrary code with SYSTEM privileges. An elevation-of-privilege vulnerability allows attackers to affect the system. The vulnerability has been exploited in the wild and can be used to break out of the sandbox in Chromium. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 107.0.5304.87 **Description** The issue is related to a type confusion in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This is described as a high severity issue. The vulnerability was discovered by researchers at Avast and reported to the developer on October 25. It is noted that this is the seventh 0-day vulnerability in Chrome fixed by Google this year, and the second attributed to Avast. There is no information provided about the estimated number of potentially affected devices worldwide or specific details about real-world incidents where this issue was exploited, beyond it being actively exploited. **Recommendations** For Google Chrome versions prior to 107.0.5304.87, update to version 107.0.5304.87 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages or modules until the update can be applied.