Non notée
CVE-2021-22037 Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command
Description
Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command. The vulnerability only affects Windows installers.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| VMware InstallBuilder | Versions non publiées |
Autres CVE de VMware InstallBuilder
Les 4 CVE de VMware InstallBuilder →
CVE-2022-31694
InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent…
7.3
Élevée
CVE-2021-22038
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally…
Non notée
CVE-2020-3979
InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at…
Non notée