The new version of Lenovo System Update fixes two local privilege escalation vulnerabilities. One vulnerability is located in the tool’s help system and allows users with limited Windows accounts to start an instance of Internet Explorer with administrator privileges. The second vulnerability is also related to the way in which its name and password are generated. The tool received two other security patches this year: one in July and one in October. Those updates fixed vulnerabilities that could have allowed attackers to execute commands or to replace legitimate updates with malware.”]