Muhammad Alifa Ramdhan

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos 1380 (affected versions not specified) **Description** A Use-After-Free issue in the mobile processor leads to privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1480, 2200, and 2400 **Description** An issue was discovered in the mobile processor, where a Use-After-Free leads to privilege escalation. **Recommendations** For Samsung Mobile Processor Exynos versions 1480, 2200, and 2400, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1280, 1380, 1480, 2200, 2400 **Description** An issue was discovered in the mobile processor, where a Double Free leads to privilege escalation. **Recommendations** For Samsung Mobile Processor Exynos versions 1280, 1380, 1480, 2200, 2400, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1480 and 2400 **Description** An issue was discovered in the Samsung Mobile Processor Exynos, where the lack of a length check leads to out-of-bounds writes. **Recommendations** For Samsung Mobile Processor Exynos version 1480, consider implementing a length check to prevent out-of-bounds writes until a patch is available. For Samsung Mobile Processor Exynos version 2400, consider implementing a length check to prevent out-of-bounds writes until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1480 through 2400 **Description** An issue was discovered in the Samsung Mobile Processor Exynos, where the lack of a length check leads to out-of-bounds writes. **Recommendations** For Samsung Mobile Processor Exynos versions 1480 through 2400, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 980 through 9825, 990, 1080, 2100, 1280, 2200, and 1380 **Description** An issue was discovered in Samsung Mobile Processor Exynos, where a Double Free in the mobile processor leads to privilege escalation. **Recommendations** For Samsung Mobile Processor Exynos versions 980 through 9825, 990, 1080, 2100, 1280, 2200, and 1380, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 980, 990, 1080, 2100, 1280, 2200, 1380 **Description** A Use-After-Free issue in the mobile processor leads to privilege escalation. **Recommendations** For Samsung Mobile Processor Exynos versions 980, 990, 1080, 2100, 1280, 2200, 1380, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1280, 1380, 1480, 2200, 2400 **Description** An issue was discovered in Samsung Mobile Processor Exynos, where the absence of a NULL check leads to a Denial of Service. **Recommendations** For Samsung Mobile Processor Exynos versions 1280, 1380, 1480, 2200, 2400, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1280, 1380, 1480, 2200, 2400 **Description** A Double Free issue in the mobile processor can lead to privilege escalation. This issue affects Samsung Mobile Processor Exynos models 1280, 1380, 1480, 2200, and 2400. **Recommendations** For Samsung Mobile Processor Exynos versions 1280, 1380, 1480, 2200, 2400, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos 1380 (affected versions not specified) **Description** An issue was discovered in the Samsung Mobile Processor Exynos 1380, where the lack of a length check leads to out-of-bounds writes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1480 and 2400 **Description** The issue is related to the lack of a length check, which leads to out-of-bounds writes. This problem was discovered in the Samsung Mobile Processor Exynos. **Recommendations** For Samsung Mobile Processor Exynos versions 1480 and 2400, consider implementing a length check to prevent out-of-bounds writes until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1480, 2200, and 2400 **Description** A Use-After-Free issue in the mobile processor can lead to privilege escalation. **Recommendations** For Samsung Mobile Processor Exynos versions 1480, 2200, and 2400, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Processor Exynos versions 1480, 2200, and 2400 **Description** A Use-After-Free issue in the mobile processor leads to privilege escalation. **Recommendations** For Samsung Mobile Processor Exynos versions 1480, 2200, and 2400, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.29.0 Description: The issue is related to insufficient restriction of the communication channel for given endpoints, allowing an attacker who has gained access to the Docker Desktop VM through a container breakout to further escape to the host by passing extensions and dashboard related IPC messages. Exploitation requires the "Allow only extensions distributed through the Docker Marketplace" setting to be disabled. Recommendations: For Docker Desktop versions prior to 4.29.0, update to version 4.29.0 or later to fix the issue on MacOS, Linux, and Windows with Hyper-V backend. Additionally, consider enabling the "Allow only extensions distributed through the Docker Marketplace" setting by default, as introduced in Docker Desktop version 4.31.0, to prevent exploitation. As a temporary workaround, consider disabling the extension-manager until a patch is available. Restrict access to the vulnerable IPC messages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.46 Oracle VM VirtualBox versions prior to 7.0.10 **Description** The issue allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox. The vulnerability exists due to insufficient input validation. **Recommendations** For versions prior to 6.1.46, update to version 6.1.46 or later. For versions prior to 7.0.10, update to version 7.0.10 or later. As a temporary workaround, consider restricting access to the virtual machine to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.1.3 Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.1.3, consider disabling the Toolgate component until a patch is available. Restrict access to the Toolgate component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the `lsi do msgout` function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.20 **Description** The issue is related to a buffer read operation that can lead to unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. It affects the Core component of Oracle VM VirtualBox and can be exploited by a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes. Successful attacks may significantly impact additional products. **Recommendations** For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.