Details of VAR-201901-0846

ID

VAR-201901-0846

CVE

CVE-2018-16098

TITLE

plural Lenovo ThinkPad Product Synaptics Pointing Vulnerabilities related to unquoted search paths or elements in devices

Trust: 0.8

sources: JVNDB: JVNDB-2018-014622

DESCRIPTION

In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user. plural Lenovo ThinkPad Product Synaptics Pointing The device contains a vulnerability with unquoted search paths or elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Lenovo ThinkPad Helix 20CG and others are notebook computer products of China Lenovo (Lenovo). Synaptics Pointing Device is one of the joystick and touchpad drivers. A security vulnerability exists in the Synaptics Pointing Device driver in several Lenovo products. An attacker could exploit this vulnerability to execute code. The following products are affected: Lenovo ThinkPad Helix 20CG; ThinkPad Helix 20CH; ThinkPad Helix (3xxx); ThinkPad L430/L530; ThinkPad P50 20EN; ThinkPad P50 20EQ;

Trust: 1.71

sources: NVD: CVE-2018-16098 // JVNDB: JVNDB-2018-014622 // VULHUB: VHN-126423

AFFECTED PRODUCTS

vendor:	lenovo	model:	thiankpad p51	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	synaptics thinkpad ultranav driver	scope:	eq	version:	19.5.19.33	Trust: 1.0
vendor:	lenovo	model:	thinkpad t470	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t530i	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t540p	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad w550s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t431s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x230i tablet	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad p1	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad t420i	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t430i	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad s430	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x240s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x220	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad w541	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad yoga 11e	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x250	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x240	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	synaptics thinkpad ultranav driver	scope:	eq	version:	18.0.7.119	Trust: 1.0
vendor:	lenovo	model:	thiankpad t420	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t430s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t550	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t520i	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t580	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad s1 yoga	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t440p	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x230 tablet	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad l430	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t460s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t570	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad twist	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 carbon	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x230i	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x280	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad p50s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 hybrid	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x220i	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t530	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad s230u	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad w540	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t420s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	synaptics thinkpad ultranav driver	scope:	eq	version:	19.0.17.140	Trust: 1.0
vendor:	lenovo	model:	thinkpad t470s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t540	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 yoga	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x230s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad p70	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	synaptics thinkpad ultranav driver	scope:	eq	version:	16.2.19.23	Trust: 1.0
vendor:	lenovo	model:	thinkpad t440	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad helix	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad p52s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	synaptics thinkpad ultranav driver	scope:	eq	version:	18.1.27.42	Trust: 1.0
vendor:	lenovo	model:	thiankpad l530	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t520	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x220 tablet	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t560	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thiankpad p51s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	synaptics thinkpad ultranav driver	scope:	eq	version:	19.3.4.219	Trust: 1.0
vendor:	lenovo	model:	thiankpad x1 extreme	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t440s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad x230	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad w530	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkpad t420si	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	synaptics thinkpad ultranav driver	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad l430	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad l530	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad p1	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad p50s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad p51	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad p51s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad p52s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thiankpad x1 extreme	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkpad helix	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2018-014622 // NVD: CVE-2018-16098

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-16098
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-16098
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201901-435
value:	HIGH
Trust: 0.6
VULHUB:	VHN-126423
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-16098
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-126423
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-16098
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-126423 // JVNDB: JVNDB-2018-014622 // CNNVD: CNNVD-201901-435 // NVD: CVE-2018-16098

PROBLEMTYPE DATA

problemtype:

CWE-428

Trust: 1.9

sources: VULHUB: VHN-126423 // JVNDB: JVNDB-2018-014622 // NVD: CVE-2018-16098

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201901-435

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201901-435

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-014622

PATCH

title:	LEN-24573	url:	https://support.lenovo.com/jp/ja/product_security/len-24573	Trust: 0.8
title:	Multiple Lenovo product Synaptics Pointing Device Driver security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=88599	Trust: 0.6

sources: JVNDB: JVNDB-2018-014622 // CNNVD: CNNVD-201901-435

EXTERNAL IDS

db:	NVD	id:	CVE-2018-16098	Trust: 2.5
db:	LENOVO	id:	LEN-24573	Trust: 1.7
db:	JVNDB	id:	JVNDB-2018-014622	Trust: 0.8
db:	CNNVD	id:	CNNVD-201901-435	Trust: 0.7
db:	VULHUB	id:	VHN-126423	Trust: 0.1

sources: VULHUB: VHN-126423 // JVNDB: JVNDB-2018-014622 // CNNVD: CNNVD-201901-435 // NVD: CVE-2018-16098

REFERENCES

url:	https://support.lenovo.com/us/en/solutions/len-24573	Trust: 1.7
url:	https://support.lenovo.com/bg/en/product_security/len-24573	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16098	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-16098	Trust: 0.8
url:	https://support.lenovo.com/us/en/product_security/len-24573	Trust: 0.6

sources: VULHUB: VHN-126423 // JVNDB: JVNDB-2018-014622 // CNNVD: CNNVD-201901-435 // NVD: CVE-2018-16098

SOURCES

db:	VULHUB	id:	VHN-126423
db:	JVNDB	id:	JVNDB-2018-014622
db:	CNNVD	id:	CNNVD-201901-435
db:	NVD	id:	CVE-2018-16098

LAST UPDATE DATE

2024-11-23T23:01:53.697000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-126423	date:	2019-05-08T00:00:00
db:	JVNDB	id:	JVNDB-2018-014622	date:	2019-03-29T00:00:00
db:	CNNVD	id:	CNNVD-201901-435	date:	2019-08-29T00:00:00
db:	NVD	id:	CVE-2018-16098	date:	2024-11-21T03:52:06.210

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-126423	date:	2019-01-24T00:00:00
db:	JVNDB	id:	JVNDB-2018-014622	date:	2019-03-29T00:00:00
db:	CNNVD	id:	CNNVD-201901-435	date:	2019-01-14T00:00:00
db:	NVD	id:	CVE-2018-16098	date:	2019-01-24T22:29:00.260