High WID-SEC-2024-0385 7 CVEs

Zoom Video Communications Zoom Client: Mehrere Schwachstellen

Published Feb 13, 2024 · Updated Nov 11, 2024 · Revision 3 · de-DE

Vendor: Zoom Video Communications Product: Zoom Client Platform: Android Platform: iOS Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Zoom Video Communications Zoom Client ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder seine Berechtigungen zu erweitern.

Product

Zoom bietet Kommunikationssoftware, die Videokonferenzen, Online-Besprechungen, Chat und mobile Zusammenarbeit kombiniert.

Vulnerabilities 7

Critical 9.6

CVE-2024-24691

Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Zoom Video Communications Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows Windows

Feb 14, 2024
High 7.2

CVE-2024-24697

Zoom Clients - Untrusted Search Path

Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.

Zoom Video Communications Zoom Clients

Feb 13, 2024
Medium 6.8

CVE-2024-24695

Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.

Zoom Video Communications Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows Windows

Feb 13, 2024
Medium 6.8

CVE-2024-24696

Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.

Zoom Video Communications Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows Windows

Feb 13, 2024
Medium 6.5

CVE-2024-24699

Zoom Clients - Business Logic Error

Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.

Zoom Video Communications Zoom Clients

Feb 13, 2024
Medium 5.4

CVE-2024-24690

Zoom Clients - Improper Input Validation

Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access.

Zoom Video Communications Zoom Clients

Feb 14, 2024
Medium 4.9

CVE-2024-24698

Zoom Clients - Improper Authentication

Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.

Zoom Video Communications Zoom Clients

Feb 13, 2024

Revision history

2024-11-11 #3
doppelte CVE entfernt
2024-02-14 #2
Korrektur Produktzuordnung
2024-02-13 #1
Initiale Fassung

References

Zoom Secur vom 2024-02-13
https://www.zoom.com/en/trust/security-bulletin