SB2023053019 - Multiple vulnerabilities in Wacom Drivers for Windows

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Link following (CVE-ID: CVE-2023-32163)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a link following issue within the Tablet Service, which leads to security restrictions bypass and privilege escalation.

2) Incorrect Privilege Assignment (CVE-ID: CVE-2023-32162)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect permissions when handling the WacomInstallI.txt file by the PrefUtil.exe utility, which leads to security restrictions bypass and privilege escalation.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.zerodayinitiative.com/advisories/ZDI-23-742/
• https://www.zerodayinitiative.com/advisories/ZDI-23-741/