SECURITY BULLETIN: Trend Micro Security 2019 (Consumer) Local Privilege Escalation Vulnerability
CVE Vulnerability Identifier(s): CVE-2019-14685
CVSS 3.0 Scores: 6.3
Severity Ratings: Medium
Trend Micro has released updates to the Trend Micro Security 2019 (version 15.0) family of consumer products which resolve a local privilege escalation vulnerability.
|Premium Security||2019 (v15.0)||Microsoft Windows||English|
|Antivirus + Security||
|All Versions Above||15.0 with plugservicebundle.dll v15.0.1239||Microsoft Windows||English|
Trend Micro has addressed these vulnerabilities via a patch that is available now through the product’s automatic ActiveUpdate feature for all versions of Trend Micro Security 2019 (version 15) listed above.
This patch includes mitigation for the following vulnerabilities:
- CVE-2019-14685: A local privilege escalation vulnerability exists in the versions of Trend Micro Security 2019 listed above in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service.
Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.
Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.
Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.
Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:
- Silton of Tempest Security Intelligence
Customers who have questions are encouraged to contact Trend Micro Technical Support for further assistance.