CVSS: 9.8EPSS: 0%CPEs: 51EXPL: 0CVE-2021-34423 – Buffer overflow in Zoom client and other products
https://notcve.org/view.php?id=CVE-2021-34423
A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115, Zoom On-Premise Recording Connector before version 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code. Se ha detectado una vulnerabilidad de desbordamiento de búfer en Zoom Client for Meetings (para Android, iOS, Linux, macOS y Windows) antes de la versión 5.8.4, Zoom Client for Meetings for Blackberry (para Android e iOS) antes de la versión 5.8.1, Zoom Client for Meetings for intune (para Android e iOS) antes de la versión 5.8.4, Zoom Client for Meetings for Chrome OS antes de la versión 5.0.1, Zoom Rooms for Conference Room (para Android, AndroidBali, macOS y Windows) antes de la versión 5. 8.3, Controllers for Zoom Rooms (para Android, iOS y Windows) antes de la versión 5.8.3, Zoom VDI Windows Meeting Client antes de la versión 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (para Windows x86 o x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) antes de la versión 5. 8.4.21112, Zoom VDI Citrix Plugins (para Windows x86 o x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) antes de la versión 5.8.4. 21112, Zoom VDI VMware Plugins (para Windows x86 o x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) antes de la versión 5.8.4.21112, Zoom Meeting SDK para Android antes de la versión 5. 7.6.1922, Zoom Meeting SDK para iOS antes de la versión 5.7.6.1082, Zoom Meeting SDK para macOS antes de la versión 5.7.6.1340, Zoom Meeting SDK para Windows antes de la versión 5.7.6.1081, Zoom Video SDK (para Android, iOS, macOS y Windows) antes de la versión 1. 1.2, Zoom On-Premise Meeting Connector Controller antes de la versión 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR antes de la versión 4.8.12.20211115, Zoom On-Premise Recording Connector antes de la versión 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector antes de la versión 4. 4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer antes de la versión 2.5.5692.20211117, Zoom Hybrid Zproxy antes de la versión 1.0.1058.20211116, y Zoom Hybrid MMR antes de la versión 4.6.20211116.131_x86-64. Esto puede permitir potencialmente a un actor malicioso bloquear el servicio o la aplicación, o aprovechar esta vulnerabilidad para ejecutar código arbitrario Zoom suffers from a buffer overflow vulnerability related to the processing of chat message. • http://packetstormsecurity.com/files/165417/Zoom-Chat-Message-Processing-Buffer-Overflow.html https://explore.zoom.us/en/trust/security/security-bulletin • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34419 – HTML injection in Zoom Linux client
https://notcve.org/view.php?id=CVE-2021-34419
In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the process of in-meeting screen sharing. This could allow meeting participants to be targeted for social engineering attacks. En Zoom Client for Meetings para Ubuntu Linux versiones anteriores a 5.1.0, se presenta un fallo de inyección de HTML cuando es enviada una petición de control remoto a un usuario en el proceso de compartir la pantalla en una reunión. Esto podría permitir que participantes en la reunión sean objeto de ataques de ingeniería social • https://explore.zoom.us/en/trust/security/security-bulletin • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34420 – Zoom Windows installation executable signature bypass
https://notcve.org/view.php?id=CVE-2021-34420
The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer. El instalador de Zoom Client for Meetings para Windows anterior a la versión 5.5.4 no verifica correctamente la firma de los archivos con extensiones .msi, .ps1 y .bat. Esto podría dar lugar a que un actor malintencionado instalara software malicioso en el ordenador de un cliente • https://explore.zoom.us/en/trust/security/security-bulletin https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e • CWE-347: Improper Verification of Cryptographic Signature •