CVE-2019-6188

CVE-2019-6188 affects Lenovo ThinkPad T460p and T470p where the BIOS tamper-detection mechanism failed to trigger, potentially enabling unauthorized access. Reported by multiple sources (NVD entry mirrors Lenovo advisory LEN-27714 and Red Hat/RH-CVE mappings) with BIOS versions up to R07ET90W (T4...

CVE-2019-6188 ThinkPad T460p and T470p BIOS Tamper Mechanism

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access...

CVE-2019-6170

CVE-2019-6170 describes a potential vulnerability in the SMI callback function used by the Legacy USB driver (runtime phase boot services) on some Lenovo ThinkPad models, potentially allowing arbitrary code execution. Reported in Lenovo’s advisory LEN-27714 and mirrored in vendor/NVD entries, the...

CVE-2019-6172

CVE-2019-6172 involves a vulnerability in the SMI callback function in some Lenovo ThinkPad models’ Legacy USB driver, where a passed parameter is used without sufficient validation. This could allow arbitrary code execution in the context of the affected system. Public documentation consistently...

Lenovo ThinkPad CVE-2019-6170 Remote Code Execution Vulnerability

Description Lenovo ThinkPad is prone to a remote code-execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Technologies Affected Lenovo Thinkpad Recommendations Block external access at the network...

Lenovo ThinkPad CVE-2019-6172 Remote Code Execution Vulnerability

Description Lenovo is prone to a remote code-execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Technologies Affected Lenovo Thinkpad Recommendations Block external access at the network boundary, unle...

Lenovo Power Management Driver Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-29334 Potential Impact: Denial of Service Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-6192 Summary Description: A potential vulnerability has been reported in the Lenovo Power Management Driver which could lead to a denial of service...

Lenovo Power Management Driver Vulnerability - Lenovo Support US

No description provided...

Design/Logic Flaw

There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege. The following are affected products and versions: Legion Y520TZ370 6.0.1.8642, AIO310-20IAP 6.0.1.8642, AIO510-22ISH 6.0.1.8642...

CVE-2019-10724

There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege. The following are affected products and versions: Legion Y520TZ370 6.0.1.8642, AIO310-20IAP 6.0.1.8642, AIO510-22ISH 6.0.1.8642...

CVE-2019-6171

A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware...

Design/Logic Flaw

A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware...

CVE-2019-6171

CVE-2019-6171 affects older ThinkPad models where an attacker with administrative privileges or physical access can cause the Embedded Controller to accept unsigned firmware updates. Root cause is unsigned firmware update capability in the EC, enabling privilege escalation via BIOS/EC update path...

CVE-2019-6171

A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware...

PT-2019-18002 · Lenovo · Thinkpad

Name of the Vulnerable Software and Affected Versions: ThinkPad systems affected versions not specified Description: A reported issue in certain ThinkPad systems' BIOS could allow a user with administrative privileges or physical access to update the Embedded Controller with unsigned firmware...

Lenovo Warns of ThinkPad Bugs, One Unpatched

Dozens of Lenovo’s flagship ThinkPad models are vulnerable to bugs ranging in severity from low to high. Two of the flaws are tied to industry-wide security bulletins, while a medium-severity flaw affects only Lenovo laptops but remains unpatched. The most severe of the three bugs is a...

Embedded Controller Update Vulnerability - US

Lenovo Security Advisory: LEN-27764 Potential Impact: Privilege escalation Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-6171 Summary Description: A vulnerability was reported in older ThinkPad systems that could allow a user with administrative privileges or physical...

Lenovo Bootable Generator Vulnerability - US

Lenovo Security Advisory: LEN-25401 Potential Impact: Code execution Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-6154 Summary Description: A DLL search path vulnerability was reported in Lenovo Bootable Generator that could allow a malicious user with local access t...

Lenovo Bootable Generator Vulnerability - Lenovo Support US

No description provided...

Lenovo Patches Intel Firmware Flaws in Multiple Product Lines

Lenovo has patched several several high-severity vulnerabilities tied to Intel flaws that could enable escalation of privilege, information disclosure, or even denial of service. Overall the device maker patched flaws tied to 16 high-severity CVEs on Thursday. Those include five related to Intel...