CVE-2014-5307 – Privilege Escalation in Panda Security Products
Vulnerability title: Privilege Escalation in Panda Security
Vendor: Panda Security
Affected version: Panda 2014 Products
Fixed version: Hotfix hft131306s24_r1
Reported by: Kyriakos Economou
Latest, and possibly earlier builds, of the PavTPK.sys kernel mode driver of Panda Security software suffer from a heap overflow bug that allows any user to elevate their privileges through an IOCTL request and execute code as SYSTEM by controlling the EIP via a corrupted kernel object.
All Panda Security products using the faulty driver were found to be vulnerable.