This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Epic Games Launcher versions prior to 8.2.2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.epicgames.launcher protocol. A crafted URI with the com.epicgames.launcher protocol can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-7241.
Esta vulnerabilidad permite que atacantes remotos ejecuten código arbitrario en instalaciones vulnerables de Epic Games Launcher, en versiones anteriores a la 8.2.2. Se requiere de interacción del usuario para explotar esta vulnerabilidad en la que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. Este error en concreto existe en el manejador del protocolo com.epicgames.launcher. Un URI manipulada con el protocolo com.epicgames.launcher puede desencadenar la ejecución de una llamada del sistema compuesta de una cadena proporcionada por el usuario. Un atacante podría aprovecharse de esta vulnerabilidad para ejecutar código en el contexto del actual usuario. Anteriormente era ZDI-CAN-7241.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Visual Studio with tools for Unreal Engine development installed. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handler for the com.epicgames.launcher protocol. A crafted URI with the com.epicgames.launcher protocol can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the current user.
