CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2234
https://notcve.org/view.php?id=CVE-2015-2234
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated. Condición de carrera en Lenovo System Update (anteriormente ThinkVantage System Update) anterior a 5.06.0034 utiliza permisos de lectura universal para el directorio de los ficheros de actualizaciones, lo que permite usuarios locales ganar privilegios mediante la escritura de un fichero de actualización después de que se valida la firma. • http://securitytracker.com/id/1032268 http://support.lenovo.com/us/en/product_security/lsu_privilege http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf http://www.securityfocus.com/bid/74634 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2233
https://notcve.org/view.php?id=CVE-2015-2233
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate. Lenovo System Update (anteriormente ThinkVantage System Update) anterior a 5.06.0034 no valida correctamente las cadenas CA durante la validación de firmas, lo que permite a atacantes man-in-the-middle subir y ejecutar ficheros arbitrarios a través de un certificado manipulado. • http://securitytracker.com/id/1032268 http://support.lenovo.com/us/en/product_security/lsu_privilege http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf http://www.securityfocus.com/bid/74642 • CWE-310: Cryptographic Issues •