CVE-2015-2234

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

CVE-2015-2234: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

CVE-2015-2219: Undefined Security Weakness

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service SUService.exe through an unspecified named pipe...

PT-2015-5671

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description The issue allows local users to gain privileges by sending a valid token with a command to the System Update service through an unspecified named pipe, due to the use of predictable...

PT-2015-5677

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description A race condition issue exists due to world-writable permissions for the update files directory. This allows local users to gain privileges by writing to an update file after the...

CVE-2015-2233: Undefined Security Weakness

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...

PT-2015-5676

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description The issue arises from improper validation of CA chains during signature validation, allowing man-in-the-middle attackers to upload and execute arbitrary files using a crafted...

[USN-2597-2] Linux kernel (Trusty HWE) regression

========================================================================== Ubuntu Security Notice USN-2597-2 May 08, 2015 linux-lts-trusty regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Lenovo ThinkPad series computers was traced to multiple security vulnerabilities-vulnerability warning-the black bar safety net

Recently, security firm IOActive at the Lenovo Series of computers found a security vulnerability, the attacker may be on the computers of legitimate applications replaced with malicious app and you can remotely execute malicious instructions. IOActive security researcher in the Bulletin elaborat...

Lenovo System Update Download File Replacement Vulnerability

Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update system downloads application updates to a writable directory, allowing local users to replace downloaded files and elevate permissions...

Lenovo System Update Security Token Predicts Arbitrary Code Execution Vulnerability

Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update uses predictable security tokens to access the update mechanism, allowing local users to guess security tokens, provide tokens to the system upgrade service, and execute arbitrary commands...

Lenovo System Update Correct Checksum Bypass Vulnerability

Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update fails to properly validate the Lenovo System Update CA certificate chain, allowing remote attackers who can conduct man-in-the-middle attacks to bypass signature validation, replace Lenovo applications, and execute...

Lenovo System Update Vulnerabilities Patched

Still reeling from the Superfish vulnerability, three more serious vulnerabilities have been patched and disclosed in Lenovo’s update system for its PCs. Researchers at IOActive yesterday disclosed details on a trio of security issues related to the mechanism by which Lenovo machines are sent...

KLA10572 Multiple vulnerabilities in Lenovo System Update

Multiple serious vulnerabilities have been found in Lenovo System Update. Malicious users can exploit these vulnerabilities to bypass security restrictions or gain privileges. Below is a complete list of vulnerabilities 1. Lack of command piping restrictions can be exploited locally via named pip...

Lenovo System Update - Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lenovo System Update Privilege Escalation', 'Description' = %q The named pipe, \SUPipeServer, can be accessed by normal users to interact with the...

Lenovo System Update Privilege Escalation

The named pipe, \SUPipeServer, can be accessed by normal users to interact with the System update service. The service provides the possibility to execute arbitrary commands as SYSTEM if a valid security token is provided. This token can be generated by calling the GetSystemInfoData function in t...

[USN-2522-1] ICU vulnerabilities

========================================================================== Ubuntu Security Notice USN-2522-1 March 05, 2015 icu vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

U-mail Mail Service system to the latest version 3 SQL injection vulnerability package-vulnerability warning-the black bar safety net

Injection point 1: \client\mail\module\views.php: code area if ACTION == "mail-compose" $draftmail = gss $GET'draft' ; $forwardmail = gss $GET'forward' ; $replymail = gss $GET'reply' ; $mailbox = gss $GET'mailbox' ; $writeagain = gss $GET'writeagain' ; $issendfile = gss $GET'sendfile' ; $isshare ...

GHOST glibc Vulnerability Affects WordPress and PHP applications

After the disclosure of extremely critical GHOST vulnerability in the GNU C library glibc — a widely used component of most Linux distributions, security researchers have discovered that PHP applications, including the WordPress Content Management System CMS, could also be affected by the bug...

Important: xorg-x11-server

Issue Overview: Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol and GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server...