csaf_certbund - wid-sec-w-2025-1009

wid-sec-w-2025-1009

Vulnerability from csaf_certbund

Published

2025-05-12 22:00

Modified

2025-05-12 22:00

Summary

Zoom Video Communications Workplace und Rooms: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Zoom Workplace ist eine Plattform, die Videokonferenz-, Chat-, Telefon- und Collaboration-Tools integriert, um Remote- und Hybrid-Arbeitsumgebungen in Unternehmen zu unterstützen. Zoom Rooms ist ein softwarebasiertes Raumsystem, das integrierte Audiokonferenzen, drahtlose Bildschirmfreigabe und Videokonferenzen ermöglicht.

Angriff

Ein Angreifer kann mehrere Schwachstellen in Zoom Video Communications Workplace und Zoom Video Communications Rooms ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu verursachen und andere nicht spezifizierte Angriffe durchzuführen.

Betroffene Betriebssysteme

- Android - Linux - MacOS X - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Zoom Workplace ist eine Plattform, die Videokonferenz-, Chat-, Telefon- und Collaboration-Tools integriert, um Remote- und Hybrid-Arbeitsumgebungen in Unternehmen zu unterst\u00fctzen.\r\nZoom Rooms ist ein softwarebasiertes Raumsystem, das integrierte Audiokonferenzen, drahtlose Bildschirmfreigabe und Videokonferenzen erm\u00f6glicht.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Zoom Video Communications Workplace und Zoom Video Communications Rooms ausnutzen, um seine Privilegien zu erh\u00f6hen, einen Denial-of-Service-Zustand zu verursachen und andere nicht spezifizierte Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Android\n- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1009 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1009.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1009 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1009"
      },
      {
        "category": "external",
        "summary": "ZOOM Security Bulletin vom 2025-05-12",
        "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25016/"
      },
      {
        "category": "external",
        "summary": "ZOOM Security Bulletin vom 2025-05-12",
        "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25017/"
      },
      {
        "category": "external",
        "summary": "ZOOM Security Bulletin vom 2025-05-12",
        "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25018/"
      },
      {
        "category": "external",
        "summary": "ZOOM Security Bulletin vom 2025-05-12",
        "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25019/"
      },
      {
        "category": "external",
        "summary": "ZOOM Security Bulletin vom 2025-05-12",
        "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25020/"
      },
      {
        "category": "external",
        "summary": "ZOOM Security Bulletin vom 2025-05-12",
        "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25021/"
      },
      {
        "category": "external",
        "summary": "ZOOM Security Bulletin vom 2025-05-12",
        "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25022/"
      }
    ],
    "source_lang": "en-US",
    "title": "Zoom Video Communications Workplace und Rooms: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-05-12T22:00:00.000+00:00",
      "generator": {
        "date": "2025-05-13T10:21:01.875+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.12"
        }
      },
      "id": "WID-SEC-W-2025-1009",
      "initial_release_date": "2025-05-12T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-05-12T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Controller \u003c6.4.0",
                "product": {
                  "name": "Zoom Video Communications Rooms Controller \u003c6.4.0",
                  "product_id": "T043577"
                }
              },
              {
                "category": "product_version",
                "name": "Controller 6.4.0",
                "product": {
                  "name": "Zoom Video Communications Rooms Controller 6.4.0",
                  "product_id": "T043577-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zoom:rooms:controller__6.4.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Client \u003c6.4.0",
                "product": {
                  "name": "Zoom Video Communications Rooms Client \u003c6.4.0",
                  "product_id": "T043578"
                }
              },
              {
                "category": "product_version",
                "name": "Client 6.4.0",
                "product": {
                  "name": "Zoom Video Communications Rooms Client 6.4.0",
                  "product_id": "T043578-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zoom:rooms:client__6.4.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rooms"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Desktop \u003c6.4.0",
                "product": {
                  "name": "Zoom Video Communications Workplace Desktop \u003c6.4.0",
                  "product_id": "T043574"
                }
              },
              {
                "category": "product_version",
                "name": "Desktop 6.4.0",
                "product": {
                  "name": "Zoom Video Communications Workplace Desktop 6.4.0",
                  "product_id": "T043574-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zoom:workplace:desktop__6.4.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "App \u003c6.4.0",
                "product": {
                  "name": "Zoom Video Communications Workplace App \u003c6.4.0",
                  "product_id": "T043575"
                }
              },
              {
                "category": "product_version",
                "name": "App 6.4.0",
                "product": {
                  "name": "Zoom Video Communications Workplace App 6.4.0",
                  "product_id": "T043575-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zoom:workplace:app__6.4.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "VDI Client for Windows \u003c6.3.10",
                "product": {
                  "name": "Zoom Video Communications Workplace VDI Client for Windows \u003c6.3.10",
                  "product_id": "T043576"
                }
              },
              {
                "category": "product_version",
                "name": "VDI Client for Windows 6.3.10",
                "product": {
                  "name": "Zoom Video Communications Workplace VDI Client for Windows 6.3.10",
                  "product_id": "T043576-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zoom:workplace:vdi_client_for_windows__6.3.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Workplace"
          }
        ],
        "category": "vendor",
        "name": "Zoom Video Communications"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-30663",
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00",
      "title": "CVE-2025-30663"
    },
    {
      "cve": "CVE-2025-30664",
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00",
      "title": "CVE-2025-30664"
    },
    {
      "cve": "CVE-2025-30665",
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00",
      "title": "CVE-2025-30665"
    },
    {
      "cve": "CVE-2025-30666",
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00",
      "title": "CVE-2025-30666"
    },
    {
      "cve": "CVE-2025-30667",
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00",
      "title": "CVE-2025-30667"
    },
    {
      "cve": "CVE-2025-30668",
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00",
      "title": "CVE-2025-30668"
    },
    {
      "cve": "CVE-2025-46785",
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00",
      "title": "CVE-2025-46785"
    },
    {
      "product_status": {
        "known_affected": [
          "T043575",
          "T043576",
          "T043577",
          "T043578",
          "T043574"
        ]
      },
      "release_date": "2025-05-12T22:00:00.000+00:00"
    }
  ]
}

CVE-2025-30663 (GCVE-0-2025-30663)

Vulnerability from cvelistv5

Published

2025-05-14 17:31

Modified

2025-05-17 03:56

Severity ?

8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Summary

Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.

References

►

URL

Tags

https://www.zoom.com/en/trust/security-bulletin/zsb-25016

Impacted products

	Vendor	Product	Version
	Zoom Communications, Inc	Zoom Workplace Apps	Version: see references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30663",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-17T03:56:04.512Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android"
          ],
          "product": "Zoom Workplace Apps",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access."
            }
          ],
          "value": "Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T17:31:03.695Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25016"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps - Time-of-check Time-of-use",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-30663",
    "datePublished": "2025-05-14T17:31:03.695Z",
    "dateReserved": "2025-03-24T22:35:25.475Z",
    "dateUpdated": "2025-05-17T03:56:04.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30664 (GCVE-0-2025-30664)

Vulnerability from cvelistv5

Published

2025-05-14 17:33

Modified

2025-05-17 03:56

Severity ?

6.6 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Summary

Improper neutralization of special elements in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.

References

►

URL

Tags

https://www.zoom.com/en/trust/security-bulletin/zsb-25017

Impacted products

	Vendor	Product	Version
	Zoom Communications, Inc	Zoom Workplace Apps	Version: see references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30664",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-17T03:56:05.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android"
          ],
          "product": "Zoom Workplace Apps",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Improper neutralization of special elements in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T17:33:18.777Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25017"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps - Improper Neutralization of Special Elements",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-30664",
    "datePublished": "2025-05-14T17:33:18.777Z",
    "dateReserved": "2025-03-24T22:35:25.475Z",
    "dateUpdated": "2025-05-17T03:56:05.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30667 (GCVE-0-2025-30667)

Vulnerability from cvelistv5

Published

2025-05-14 17:36

Modified

2025-05-14 19:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Summary

NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

References

►

URL

Tags

https://www.zoom.com/en/trust/security-bulletin/zsb-25019

Impacted products

	Vendor	Product	Version
	Zoom Communications, Inc	Zoom Workplace Apps	Version: see references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30667",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-14T18:01:22.177422Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-14T19:00:20.154Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android"
          ],
          "product": "Zoom Workplace Apps",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.\u003cbr\u003e"
            }
          ],
          "value": "NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T17:36:19.136Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25019"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps - NULL Pointer Dereference",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-30667",
    "datePublished": "2025-05-14T17:36:19.136Z",
    "dateReserved": "2025-03-24T22:35:25.475Z",
    "dateUpdated": "2025-05-14T19:00:20.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30666 (GCVE-0-2025-30666)

Vulnerability from cvelistv5

Published

2025-05-14 17:35

Modified

2025-05-14 19:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Summary

NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

References

►

URL

Tags

https://www.zoom.com/en/trust/security-bulletin/zsb-25018

Impacted products

	Vendor	Product	Version
	Zoom Communications, Inc	Zoom Workplace Apps for Windows	Version: see references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-14T18:01:29.356909Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-14T19:00:27.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Zoom Workplace Apps for Windows",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.\u003cbr\u003e"
            }
          ],
          "value": "NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T17:35:15.485Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25018"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps for Windows - NULL Pointer Dereference",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-30666",
    "datePublished": "2025-05-14T17:35:15.485Z",
    "dateReserved": "2025-03-24T22:35:25.475Z",
    "dateUpdated": "2025-05-14T19:00:27.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30665 (GCVE-0-2025-30665)

Vulnerability from cvelistv5

Published

2025-05-14 17:35

Modified

2025-05-14 19:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Summary

NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

References

►

URL

Tags

https://www.zoom.com/en/trust/security-bulletin/zsb-25018

Impacted products

	Vendor	Product	Version
	Zoom Communications, Inc	Zoom Workplace Apps for Windows	Version: see references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30665",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-14T18:01:35.450813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-14T19:00:31.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Zoom Workplace Apps for Windows",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.\u003cbr\u003e"
            }
          ],
          "value": "NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T17:35:06.968Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25018"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps for Windows - NULL Pointer Dereference",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-30665",
    "datePublished": "2025-05-14T17:35:06.968Z",
    "dateReserved": "2025-03-24T22:35:25.475Z",
    "dateUpdated": "2025-05-14T19:00:31.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-46785 (GCVE-0-2025-46785)

Vulnerability from cvelistv5

Published

2025-05-14 17:41

Modified

2025-05-14 19:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Summary

Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

References

►

URL

Tags

https://www.zoom.com/en/trust/security-bulletin/zsb-25021

Impacted products

	Vendor	Product	Version
	Zoom Communications, Inc	Zoom Workplace Apps	Version: see references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46785",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-14T17:54:10.661112Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-14T19:00:08.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Zoom Workplace Apps",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T17:41:06.374Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25021"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps for Windows - Buffer Over-read",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-46785",
    "datePublished": "2025-05-14T17:41:06.374Z",
    "dateReserved": "2025-04-29T21:24:03.394Z",
    "dateUpdated": "2025-05-14T19:00:08.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30668 (GCVE-0-2025-30668)

Vulnerability from cvelistv5

Published

2025-05-14 17:39

Modified

2025-05-14 19:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Summary

Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.

References

►

URL

Tags

https://www.zoom.com/en/trust/security-bulletin/zsb-25020

Impacted products

	Vendor	Product	Version
	Zoom Communications, Inc	Zoom Workplace Apps	Version: see references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-14T17:54:24.402287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-14T19:00:14.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android"
          ],
          "product": "Zoom Workplace Apps",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-14T17:39:55.588Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25020"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps - NULL Pointer Dereference",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-30668",
    "datePublished": "2025-05-14T17:39:55.588Z",
    "dateReserved": "2025-03-24T22:35:25.475Z",
    "dateUpdated": "2025-05-14T19:00:14.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

wid-sec-w-2025-1009

Vulnerability from csaf_certbund

CVE-2025-30663 (GCVE-0-2025-30663)

Vulnerability from cvelistv5

CVE-2025-30664 (GCVE-0-2025-30664)

Vulnerability from cvelistv5

CVE-2025-30667 (GCVE-0-2025-30667)

Vulnerability from cvelistv5

CVE-2025-30666 (GCVE-0-2025-30666)

Vulnerability from cvelistv5

CVE-2025-30665 (GCVE-0-2025-30665)

Vulnerability from cvelistv5

CVE-2025-46785 (GCVE-0-2025-46785)

Vulnerability from cvelistv5

CVE-2025-30668 (GCVE-0-2025-30668)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature