CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-5447 – Use-After-Free in Service for Hardware Support App for Fingerprint Driver
https://notcve.org/view.php?id=CVE-2023-5447
Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denial of service for the Synaptics Hardware Support App. La falta de verificación de bloqueo en SynHsaService puede crear una condición de use-after-free que provoca una terminación anormal del servicio, lo que resulta en la denegación de servicio para la aplicación Synaptics Hardware Support. • https://www.synaptics.com/sites/default/files/2023-10/fingerprint-driver-HSAService-security-brief-2023-10-13.pdf • CWE-414: Missing Lock Check CWE-416: Use After Free •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6482 – Encryption key derived from static host information
https://notcve.org/view.php?id=CVE-2023-6482
Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may allow an attacker, who has physical access to the sensor, to enroll a fingerprint into the template database. El uso de una clave de cifrado derivada de información estática en Synaptics Fingerprint Driver permite a un atacante configurar una sesión TLS con el sensor de huellas digitales y enviar comandos restringidos al sensor de huellas digitales. Esto puede permitir que un atacante, que tiene acceso físico al sensor, registre una huella digital en la base de datos de la plantilla. • https://www.synaptics.com/sites/default/files/2024-01/fingerprint-driver-encryption-key-security-brief-2024-01-26.pdf • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4936 – Synaptics-DisplayLink-privilege escalation vulnerability via a dynamic library sideloading
https://notcve.org/view.php?id=CVE-2023-4936
It is possible to sideload a compromised DLL during the installation at elevated privilege. Es posible descargar una DLL comprometida durante la instalación con privilegios elevados. • https://www.synaptics.com https://www.synaptics.com/products/displaylink-graphics/downloads/windows https://www.synaptics.com/sites/default/files/nr-154525-tc-synaptics_displaylink_windows_driver_security_brief_-_oct2023.pdf • CWE-269: Improper Privilege Management CWE-427: Uncontrolled Search Path Element •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2021-3675 – synaTEE.signed.dll Out-Of-Bounds Heap Write
https://notcve.org/view.php?id=CVE-2021-3675
Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with potential loss of confidentiality. This issue affects: Synaptics Synaptics Fingerprint Driver 5.1.xxx.26 versions prior to xxx=340 on x86/64; 5.2.xxxx.26 versions prior to xxxx=3541 on x86/64; 5.2.2xx.26 versions prior to xx=29 on x86/64; 5.2.3xx.26 versions prior to xx=25 on x86/64; 5.3.xxxx.26 versions prior to xxxx=3543 on x86/64; 5.5.xx.1058 versions prior to xx=44 on x86/64; 5.5.xx.1102 versions prior to xx=34 on x86/64; 5.5.xx.1116 versions prior to xx=14 on x86/64; 6.0.xx.1104 versions prior to xx=50 on x86/64; 6.0.xx.1108 versions prior to xx=31 on x86/64; 6.0.xx.1111 versions prior to xx=58 on x86/64. Una vulnerabilidad de comprobación de entrada inapropiada en el archivo synaTEE.signed.dll de Synaptics Fingerprint Driver, permite a un atacante local autorizado sobrescribir una etiqueta de la pila, con posible pérdida de confidencialidad. Este problema afecta a: Synaptics Fingerprint Driver versiones: 5.1.xxx.26 versiones anteriores a xxx=340 en x86/64; 5.2.xxxx.26 versiones anteriores a xxxx=3541 en x86/64; 5.2.2xx.26 versiones anteriores a xx=29 en x86/64; 5.2.3xx.26 versiones anteriores a xx=25 en x86/64; 5.3.xxxx.26 versiones anteriores a xxxx=3543 en x86/64; 5.5.xx.1058 versiones anteriores a xx=44 en x86/64; 5.5.xx.1102 versiones anteriores a xx=34 en x86/64; 5.5.xx.1116 versiones anteriores a xx=14 en x86/64; 6.0.xx.1104 versiones anteriores a xx=50 en x86/64; 6.0.xx.1108 versiones anteriores a xx=31 en x86/64; 6.0.xx.1111 versiones anteriores a xx=58 en x86/64 • https://support.hp.com/us-en/document/ish_6411153-6411191-16/hpsbhf03797 https://support.lenovo.com/us/en/product_security/LEN-68054 https://synaptics.com/sites/default/files/2022-06/fingerprint-driver-SGX-security-brief-2022-06-14.pdf • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 9%CPEs: 99EXPL: 1CVE-2022-27438
https://notcve.org/view.php?id=CVE-2022-27438
Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check. Caphyon Ltd Advanced Installer 19.3 y anteriores y muchos productos que utilizan el actualizador de Advanced Installer (Advanced Updater) están afectados por una vulnerabilidad de ejecución remota de código a través del parámetro CustomDetection en la función de comprobación de actualizaciones. Para explotar esta vulnerabilidad, un usuario debe iniciar una instalación afectada para activar la comprobación de la actualización • http://advanced.com http://caphyon.com https://gerr.re/posts/cve-2022-27438 https://www.advancedinstaller.com/security-updates-auto-updater.html • CWE-494: Download of Code Without Integrity Check •