Vulnerability in Lenovo Synaptics_thinkpad_ultranav_driver
CVE-2018-16098
In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.
EPSS: 0.004 (32.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Lenovo Synaptics_thinkpad_ultranav_driver — versions 18.0.7.119, 19.5.19.33, 19.0.17.140
- Lenovo Thiankpad_l430
- Lenovo Thiankpad_l430_firmware
- Lenovo Thiankpad_l530
- Lenovo Thiankpad_l530_firmware
- Lenovo Thiankpad_p1
- Lenovo Thiankpad_p1_firmware
- Lenovo Thiankpad_p50s
- Lenovo Thiankpad_p50s_firmware
- Lenovo Thiankpad_p51
Weakness classification (CWE)
References
- psirt@lenovo.com (x_refsource_CONFIRM, Broken Link)
- nvd@nist.gov (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-16098?
- CVE-2018-16098 is a high-severity vulnerability in Lenovo Synaptics_thinkpad_ultranav_driver, classified under Unquoted Search Path or Element. CVSS score: 7.8/10. Published 2019-01-24.
- How severe is CVE-2018-16098?
- High severity. CVSS v3 base score is 7.8 out of 10.