CVE-2019-6165 - OpenCVE

A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:M/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Lenovo	Yoga 700-11isk Yoga 700-11isk Firmware Yoga 700-14isk Yoga 700-14isk Firmware

Configuration 1 [-]

AND

cpe:2.3:o:lenovo:yoga_700-11isk_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:yoga_700-11isk:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:lenovo:yoga_700-14isk_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:yoga_700-14isk:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://support.lenovo.com/solutions/LEN-27569

History

No history.

MITRE

Status: PUBLISHED

Assigner: lenovo

Published: 2019-08-19T14:56:44.995622Z

Updated: 2024-09-16T20:52:04.234Z

Reserved: 2019-01-11T00:00:00

Link: CVE-2019-6165

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-08-19T15:15:11.577

Modified: 2023-02-02T16:12:47.457

Link: CVE-2019-6165

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "PaperDisplay Hotkey Service", "vendor": "Lenovo", "versions": [{"lessThanOrEqual": "1.2.0.8", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Lenovo would like to thank Michael Bourque for reporting this issue."}], "datePublic": "2019-08-08T00:00:00", "descriptions": [{"lang": "en", "value": "A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Privilege escalation", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-08-19T14:56:44", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.lenovo.com/solutions/LEN-27569"}], "solutions": [{"lang": "en", "value": "Lenovo is not releasing updates to mitigate this vulnerability and users should uninstall PaperDisplay Hotkey Service. The Night light feature in Windows 10 provides similar functionality of the PaperDisplay Hotkey Service."}], "source": {"advisory": "LEN-27569", "discovery": "UNKNOWN"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "DATE_PUBLIC": "2019-08-08T20:00:00.000Z", "ID": "CVE-2019-6165", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PaperDisplay Hotkey Service", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_value": "1.2.0.8"}]}}]}, "vendor_name": "Lenovo"}]}}, "credit": [{"lang": "eng", "value": "Lenovo would like to thank Michael Bourque for reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Privilege escalation"}]}]}, "references": {"reference_data": [{"name": "https://support.lenovo.com/solutions/LEN-27569", "refsource": "MISC", "url": "https://support.lenovo.com/solutions/LEN-27569"}]}, "solution": [{"lang": "en", "value": "Lenovo is not releasing updates to mitigate this vulnerability and users should uninstall PaperDisplay Hotkey Service. The Night light feature in Windows 10 provides similar functionality of the PaperDisplay Hotkey Service."}], "source": {"advisory": "LEN-27569", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:16:24.325Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.lenovo.com/solutions/LEN-27569"}]}]}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2019-6165", "datePublished": "2019-08-19T14:56:44.995622Z", "dateReserved": "2019-01-11T00:00:00", "dateUpdated": "2024-09-16T20:52:04.234Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:yoga_700-11isk_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5787D70A-D365-44C7-9D70-ED27B6079106", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:yoga_700-11isk:-:*:*:*:*:*:*:*", "matchCriteriaId": "1B285B7A-0614-4618-B615-B3535CBF2FBC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:yoga_700-14isk_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D2D1470F-1F1C-455D-B755-02132AA8F706", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:yoga_700-14isk:-:*:*:*:*:*:*:*", "matchCriteriaId": "F5C2C536-A321-4F5D-BCC6-BBD6C2D457A4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features."}, {"lang": "es", "value": "Una vulnerabilidad en la ruta (path) de b\u00fasqueda de DLL fue reportada en PaperDisplay Hotkey Service versi\u00f3n 1.2.0.8, que podr\u00eda permitir una escalada de privilegios. Lenovo ha puesto fin a la compatibilidad con el programa PaperDisplay Hotkey, ya que la funcionalidad de luz nocturna que fue introducida en Windows 10 Build 1703 ofrece funcionalidades similares."}], "id": "CVE-2019-6165", "lastModified": "2023-02-02T16:12:47.457", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "psirt@lenovo.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-08-19T15:15:11.577", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/solutions/LEN-27569"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "nvd@nist.gov", "type": "Primary"}]}