SB2018100211 - Multiple vulnerabilities in nVidia GeForce Experience

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018100211

SB2018100211 - Multiple vulnerabilities in nVidia GeForce Experience

Published: October 2, 2018 Updated: July 17, 2020

Security Bulletin ID SB2018100211
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Incorrect default permissions (CVE-ID: CVE-2018-6261)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local authenticated user to execute arbitrary code.

NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which sets incorrect permissions on a file, which may to code execution, denial of service, or escalation of privileges by users with system access.


2) Information disclosure (CVE-ID: CVE-2018-6262)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local authenticated user to gain access to sensitive information.

NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled where limited sensitive user information may be available to users with system access, which may lead to information disclosure.


Remediation

Install update from vendor's website.

References