In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.
CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLenovo Synaptics Thinkpad Ultranav Driver
APPLenovo16.2.19.2318.0.7.11918.1.27.4219.0.17.14019.3.4.21919.5.19.33Lenovo Thiankpad L430
HWLenovoall versionsLenovo Thiankpad L430 Firmware
OSLenovoall versionsLenovo Thiankpad L530
HWLenovoall versionsLenovo Thiankpad L530 Firmware
OSLenovoall versionsLenovo Thiankpad P1
HWLenovoall versionsLenovo Thiankpad P1 Firmware
OSLenovoall versionsLenovo Thiankpad P50s
HWLenovoall versionsLenovo Thiankpad P50s Firmware
OSLenovoall versionsLenovo Thiankpad P51
HWLenovoall versionsLenovo Thiankpad P51 Firmware
OSLenovoall versionsLenovo Thiankpad P51s
HWLenovoall versionsLenovo Thiankpad P51s Firmware
OSLenovoall versionsLenovo Thiankpad P52s
HWLenovoall versionsLenovo Thiankpad P52s Firmware
OSLenovoall versionsLenovo Thiankpad P70
HWLenovoall versionsLenovo Thiankpad P70 Firmware
OSLenovoall versionsLenovo Thiankpad S1 Yoga
HWLenovoall versionsLenovo Thiankpad S1 Yoga Firmware
OSLenovoall versionsLenovo Thiankpad S430
HWLenovoall versionsLenovo Thiankpad S430 Firmware
OSLenovoall versionsLenovo Thiankpad T420
HWLenovoall versionsLenovo Thiankpad T420 Firmware
OSLenovoall versionsLenovo Thiankpad T420i
HWLenovoall versionsLenovo Thiankpad T420i Firmware
OSLenovoall versionsLenovo Thiankpad X1 Extreme
HWLenovoall versionsLenovo Thiankpad X1 Extreme Firmware
OSLenovoall versionsLenovo Thinkpad Helix
HWLenovoall versionsLenovo Thinkpad Helix Firmware
OSLenovoall versionsLenovo Thinkpad S230u
HWLenovoall versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
Related vulnerabilities
CVE-2020-0646CRITICAL9.8⚠ KEVPL ✓same product
RCE w Microsoft .NET Framework — nieprawidłowa walidacja danych wejściowych
CVE-2019-0708CRITICAL9.8⚠ KEVPL ✓same product
BlueKeep — krytyczny RCE w Remote Desktop Services (RDP)
CVE-2017-8543CRITICAL9.8⚠ KEVPL ✓same product
RCE w Windows Search — przejęcie kontroli nad systemem
CVE-2016-4171CRITICAL9.8⚠ KEVPL ✓same product
RCE w Adobe Flash Player 21.0.0.242 i wcześniejszych — aktywnie exploitowany
CVE-2016-1019CRITICAL9.8⚠ KEVPL ✓same product
Adobe Flash Player — RCE lub DoS przez nieokreślone wektory ataku