Details of VAR-202003-1805

ID

VAR-202003-1805

CVE

CVE-2019-19705

TITLE

plural Lenovo Vulnerability with unquoted search paths or elements in the product

Trust: 0.8

sources: JVNDB: JVNDB-2020-017572

DESCRIPTION

Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (and on many other Lenovo and non-Lenovo products), mishandles DLL preloading. plural Lenovo The product contains an unquoted search path or element vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Multiple Lenovo products could allow a local malicious user to execute arbitrary code on the system, caused by a DLL preloading issue in Realtek Audio Drivers. By placing a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary ode on the system

Trust: 1.71

sources: NVD: CVE-2019-19705 // JVNDB: JVNDB-2020-017572 // VULMON: CVE-2019-19705

AFFECTED PRODUCTS

vendor:	lenovo	model:	thinkstation p318	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e95z	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad a475	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad s2 yoga 3rd gen	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 tablet	scope:	lt	version:	6.0.8907.1	Trust: 1.0
vendor:	lenovo	model:	v410z\	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m710q	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t470	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m800	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkstation p320	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad yoga 11e 3rd gen	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510-15ikl	scope:	lt	version:	6.0.8923.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m710t\/s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 310-15asr	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8300z	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8350z	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad 13	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l480	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l570	scope:	lt	version:	6.0.8899.1	Trust: 1.0
vendor:	lenovo	model:	aio300-23isu	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	qt a7400	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t25	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad p51s	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	aio520-24iku	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 310a-15iap	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio510-22ish	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	yangtian afh110	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	legion y720t amd	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m910z	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts140	scope:	lt	version:	6.0.1.7016	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m9550z	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m910x	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8600t\/s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m910q	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l380 yoga	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	yangtian mc h110 pci	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l380	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	sydney e3 h110	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 700	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t470p	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l580	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts240	scope:	lt	version:	6.0.1.7016	Trust: 1.0
vendor:	lenovo	model:	yangtian s4150	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t460	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m6600q	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	legion y920 tower	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m810z	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m700t\/s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkstation p310	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m700z	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t480	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 yoga	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad p52s	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 520s-23iku	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l560	scope:	lt	version:	6.0.8899.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 310s-08iap	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	v320-15iap	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad s2 yoga 4th gen	scope:	lt	version:	6.0.8757.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t470s	scope:	lt	version:	6.0.8777.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m910 t\/s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio 910-27ish	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x260	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x270	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	legion y520t z370	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 carbon	scope:	lt	version:	6.0.8907.1	Trust: 1.0
vendor:	lenovo	model:	v310z\	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts450	scope:	lt	version:	6.0.1.7525	Trust: 1.0
vendor:	lenovo	model:	aio520-24ikl	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	yangtian me\/we h110	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510s-08ikl	scope:	lt	version:	6.0.8923.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m6600	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e74z	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad s3 3rd gen	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x280	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	aio520-22ikl	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad p71	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio720-24ikb	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	yangtian mf\/wf h110 pci	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m900z	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l450	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m900	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 620s-03ikl	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkstation p330	scope:	lt	version:	6.0.8923.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m800z	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts150	scope:	lt	version:	6.0.1.7525	Trust: 1.0
vendor:	lenovo	model:	legion y720 tower	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio y910-27ish	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l460	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 310-15iap	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	yangtian mc h110	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio310-20iap	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m715q	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio520-22iku	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510-15abr	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre x1 aio	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m818z	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad a275	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l470	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x250	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkstation p320 tiny	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkstation p330 tiny	scope:	lt	version:	6.0.8923.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 300s-11ish	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts550	scope:	lt	version:	6.0.1.7525	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 carbon	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m710e	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e74s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad p70	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	yta8900f	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad p50	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t560	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t450s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510s-08ish	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	yangtian tc\/wc h110 pci	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m700q	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio520-27ikl	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts250	scope:	lt	version:	6.0.1.7525	Trust: 1.0
vendor:	lenovo	model:	thinkpad yoga 11e 4th gen	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad p50s	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t480s	scope:	lt	version:	6.0.8907.1	Trust: 1.0
vendor:	lenovo	model:	yangtian afq150	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l13 yoga	scope:	lt	version:	9.0.280.80	Trust: 1.0
vendor:	lenovo	model:	thinkpad t570	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad x1 tablet	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 720-18asr	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	aio510-23ish	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad p51	scope:	lt	version:	6.0.8904.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m715t\/s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t580	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m6600t\/s	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	v510z \	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t450	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	yangtian ytm6900e-00	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t460s	scope:	lt	version:	6.0.8882.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad l390 yoga	scope:	lt	version:	6.0.8757.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m7300z	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m9500z	scope:	lt	version:	6.0.8881.1	Trust: 1.0
vendor:	lenovo	model:	thinkpad t460p	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 610s-02ish	scope:	lt	version:	6.0.8924.1	Trust: 1.0
vendor:	lenovo	model:	ideacentre 310-15iap	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 510s-08ikl	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 300s-11ish	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 510-15ikl	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 310a-15iap	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 310s-08iap	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 510-15abr	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 610s-02ish	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 510s-08ish	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 310-15asr	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-017572 // NVD: CVE-2019-19705

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-19705
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-19705
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202003-578
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2019-19705
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-19705
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2020-017572 // CNNVD: CNNVD-202003-578 // NVD: CVE-2019-19705

PROBLEMTYPE DATA

problemtype:	CWE-428	Trust: 1.0
problemtype:	unquoted search path or element (CWE-428) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-017572 // NVD: CVE-2019-19705

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202003-578

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202003-578

PATCH

title:	LEN-30506	url:	https://support.lenovo.com/us/en/product_security/ps500315-realtek-audio-driver-vulnerability	Trust: 0.8
title:	Realtek Audio Driver Security vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=112246	Trust: 0.6
title:	HP: HPSBHF03665 rev. 1 - Realtek Audio Driver Security Update	url:	https://vulmon.com/vendoradvisory?qidtp=hp_bulletin&qid=HPSBHF03665	Trust: 0.1
title:	BleepingComputer	url:	https://www.bleepingcomputer.com/news/security/realtek-fixes-dll-hijacking-flaw-in-hd-audio-driver-for-windows/	Trust: 0.1

sources: VULMON: CVE-2019-19705 // JVNDB: JVNDB-2020-017572 // CNNVD: CNNVD-202003-578

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19705	Trust: 3.3
db:	JVNDB	id:	JVNDB-2020-017572	Trust: 0.8
db:	LENOVO	id:	LEN-30506	Trust: 0.6
db:	CNNVD	id:	CNNVD-202003-578	Trust: 0.6
db:	VULMON	id:	CVE-2019-19705	Trust: 0.1

sources: VULMON: CVE-2019-19705 // JVNDB: JVNDB-2020-017572 // CNNVD: CNNVD-202003-578 // NVD: CVE-2019-19705

REFERENCES

url:	https://support.lenovo.com/us/en/product_security/ps500315-realtek-audio-driver-vulnerability	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19705	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2019-19705/	Trust: 0.6
url:	https://support.lenovo.com/us/en/product_security/len-30506	Trust: 0.6
url:	https://www.bleepingcomputer.com/news/security/realtek-fixes-dll-hijacking-flaw-in-hd-audio-driver-for-windows/	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/177491	Trust: 0.1
url:	https://support.hp.com/us-en/document/c06622884	Trust: 0.1

sources: VULMON: CVE-2019-19705 // JVNDB: JVNDB-2020-017572 // CNNVD: CNNVD-202003-578 // NVD: CVE-2019-19705

SOURCES

db:	VULMON	id:	CVE-2019-19705
db:	JVNDB	id:	JVNDB-2020-017572
db:	CNNVD	id:	CNNVD-202003-578
db:	NVD	id:	CVE-2019-19705

LAST UPDATE DATE

2024-08-14T15:43:22.356000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2020-017572	date:	2023-04-07T02:31:00
db:	CNNVD	id:	CNNVD-202003-578	date:	2023-01-09T00:00:00
db:	NVD	id:	CVE-2019-19705	date:	2023-01-06T14:22:16.630

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2020-017572	date:	2023-04-07T00:00:00
db:	CNNVD	id:	CNNVD-202003-578	date:	2020-03-10T00:00:00
db:	NVD	id:	CVE-2019-19705	date:	2022-12-26T21:15:10.437