PT-2019-9256 · Unknown+1 · Lmlzh32.Dll+2

Published 2019-02-13 · Updated 2019-02-21 · CVE-2018-16190

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UNARJ32.DLL for Win32 version 1.10.1.25 and earlier LHMelting for Win32 version 1.65.3.6 and earlier LMLzh32.DLL version 2.67.1.2 and earlier

Description The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability.

Recommendations For UNARJ32.DLL for Win32 version 1.10.1.25 and earlier, update to a version later than 1.10.1.25 to resolve the issue. For LHMelting for Win32 version 1.65.3.6 and earlier, update to a version later than 1.65.3.6 to resolve the issue. For LMLzh32.DLL version 2.67.1.2 and earlier, update to a version later than 2.67.1.2 to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2018-16190

Affected Products

Lhmelting

Lmlzh32.Dll

Unarj32.Dll

References · 7

• http://micco.mars.jp/vul/2017/mhsvi20170515_02.htm · Vendor Advisory
• http://micco.mars.jp/vul/2017/mhsvi20170515_04.htm · Vendor Advisory
• http://micco.mars.jp/vul/2017/mhsvi20170515_05.htm · Vendor Advisory
• https://micco.mars.jp/vul/2017/mhsvi20170515_03.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16190 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16190 · Vendor Advisory
• http://jvn.jp/en/jp/JVN52168232/index.html · Note