<html>
<head>
<base href="https://bugzilla.rosalinux.ru/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Platform</th>
<td>2021.1
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_CONFIRMED "
title="CONFIRMED - [CVE 21] proximity 0.0.1 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13301">13301</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[CVE 21] proximity 0.0.1 CVEs found
</td>
</tr>
<tr>
<th>Classification</th>
<td>ROSA-based products
</td>
</tr>
<tr>
<th>Product</th>
<td>ROSA Fresh
</td>
</tr>
<tr>
<th>Version</th>
<td>All
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>URL</th>
<td>CVE-2021-1240,
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>CONFIRMED
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>Normal
</td>
</tr>
<tr>
<th>Component</th>
<td>System (kernel, glibc, systemd, bash, PAM...)
</td>
</tr>
<tr>
<th>Assignee</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>Reporter</th>
<td>y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>CC</th>
<td>s.matveev@rosalinux.ru, y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>Target Milestone</th>
<td>---
</td>
</tr>
<tr>
<th>Flags</th>
<td>secteam_verified?
</td>
</tr></table>
<p>
<div>
<pre>Please patch CVEs for package proximity version 0.0.1
INFO (CVEs are): proximity 0.0.1
cves found
CVE-2021-1240
Desc: A vulnerability in the loading process of specific DLLs in Cisco
Proximity Desktop for Windows could allow an authenticated, local attacker to
load a malicious library. To exploit this vulnerability, the attacker must have
valid credentials on the Windows system. This vulnerability is due to incorrect
handling of directory paths at run time. An attacker could exploit this
vulnerability by placing a malicious DLL file in a specific location on the
targeted system. This file will execute when the vulnerable application
launches. A successful exploit could allow the attacker to execute arbitrary
code on the targeted system with the privileges of another user&rsquo;s
account.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-1240">https://nvd.nist.gov/vuln/detail/CVE-2021-1240</a>
Severity: HIGH</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>