SB2024070952 - Multiple vulnerabilities in Zoom Workplace Desktop App for Windows

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Race condition (CVE-ID: CVE-2024-39821)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition. A local user can exploit the race and escalate privileges on the system.

2) Improper privilege management (CVE-ID: CVE-2024-39819)

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management. A local user can escalate privileges on the system.

3) Input validation error (CVE-ID: CVE-2024-39827)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.zoom.com/en/trust/security-bulletin/ZSB-24028/
• https://www.zoom.com/en/trust/security-bulletin/ZSB-24026/
• https://www.zoom.com/en/trust/security-bulletin/ZSB-24024/