Medium WID-SEC-2024-1338 3 CVEs

Microsoft Visual Studio: Mehrere Schwachstellen

Published Jun 11, 2024 · Updated Jun 11, 2024 · de-DE

Vendor: Microsoft Product: Visual Studio 2017 Product: Visual Studio 2019 Product: Visual Studio 2022 Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio 2017, Microsoft Visual Studio 2019 und Microsoft Visual Studio 2022 ausnutzen, um seine Privilegien zu erhöhen oder beliebigen Programmcode auszuführen.

Product

Microsoft Visual Studio ist eine integrierte Entwicklungsumgebung für Hochsprachen.

Vulnerabilities 3

High 7.3

CVE-2024-29187

WiX based installers are vulnerable to binary hijack when run as SYSTEM

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard …

wixtoolset issues wix WixToolset.Sdk NuGet

Mar 24, 2024
Medium 6.7

CVE-2024-29060

Visual Studio Elevation of Privilege Vulnerability

Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

Jun 11, 2024
Medium 4.7

CVE-2024-30052 Public exploit

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

Jun 11, 2024

Revision history

2024-06-11 #1
Initiale Fassung

References

Microsoft Leitfaden für Sicherheitsupdates vom 2024-06-11
https://msrc.microsoft.com/update-guide