CVE-2015-5684 Memory corruption in n/a
A buffer overflow in Lenovo Service Engine allows remote attackers to execute arbitrary code on affected Lenovo notebooks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-5684?
CVE-2015-5684 is a critical memory corruption vulnerability in n/a, published on 27 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.
Weakness: CWE-120
Which versions are affected by CVE-2015-5684?
It affects 27 products.
Products include Lenovo B50-10 Firmware, Lenovo Edge 15 Firmware, Lenovo Flex 2 Pro-15 Firmware, Lenovo Flex 3-1120 Firmware, Lenovo Flex 3-1470 Firmware, Lenovo Flex 3-1570 Firmware and 21 more.
How do I fix CVE-2015-5684?
No fix has been published for CVE-2015-5684 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2015-5684 being exploited?
There is no known exploitation of CVE-2015-5684 in the wild and no public exploit code.
Sources
Also known as GHSA-xp5w-3gmw-7xvj.