Search
Find a vulnerability
Search criteria
3 vulnerabilities found for WinSparkle by WinSparkle
CVE-2016-7838 (GCVE-0-2016-7838)
Vulnerability from nvd – Published: 2017-06-09 16:00 – Updated: 2024-08-06 02:04
VLAI
EPSS
VEX
Summary
Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.
Severity
No CVSS data available.
CWE
- Untrusted search path vulnerability
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://jvn.jp/en/jp/JVN96681653/index.html | third-party-advisoryx_refsource_JVN |
| https://www.wireshark.org/news/20161214.html | x_refsource_CONFIRM |
| https://github.com/vslavik/winsparkle/commit/bb45… | x_refsource_CONFIRM |
| https://jvn.jp/en/jp/JVN90813656/index.html | third-party-advisoryx_refsource_JVN |
| http://www.securityfocus.com/bid/95099 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WinSparkle | WinSparkle |
Affected:
versions prior to 0.5.3
|
Date Public
2016-12-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:04:56.130Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#96681653",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN96681653/index.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wireshark.org/news/20161214.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913"
},
{
"name": "JVN#90813656",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN90813656/index.html"
},
{
"name": "95099",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95099"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WinSparkle",
"vendor": "WinSparkle",
"versions": [
{
"status": "affected",
"version": "versions prior to 0.5.3"
}
]
}
],
"datePublic": "2016-12-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Untrusted search path vulnerability",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-12T09:57:01.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#96681653",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "https://jvn.jp/en/jp/JVN96681653/index.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wireshark.org/news/20161214.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913"
},
{
"name": "JVN#90813656",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "https://jvn.jp/en/jp/JVN90813656/index.html"
},
{
"name": "95099",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95099"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2016-7838",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "WinSparkle",
"version": {
"version_data": [
{
"version_value": "versions prior to 0.5.3"
}
]
}
}
]
},
"vendor_name": "WinSparkle"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#96681653",
"refsource": "JVN",
"url": "https://jvn.jp/en/jp/JVN96681653/index.html"
},
{
"name": "https://www.wireshark.org/news/20161214.html",
"refsource": "CONFIRM",
"url": "https://www.wireshark.org/news/20161214.html"
},
{
"name": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913",
"refsource": "CONFIRM",
"url": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913"
},
{
"name": "JVN#90813656",
"refsource": "JVN",
"url": "https://jvn.jp/en/jp/JVN90813656/index.html"
},
{
"name": "95099",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95099"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2016-7838",
"datePublished": "2017-06-09T16:00:00.000Z",
"dateReserved": "2016-09-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T02:04:56.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7838 (GCVE-0-2016-7838)
Vulnerability from cvelistv5 – Published: 2017-06-09 16:00 – Updated: 2024-08-06 02:04
VLAI
EPSS
VEX
Summary
Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.
Severity
No CVSS data available.
CWE
- Untrusted search path vulnerability
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://jvn.jp/en/jp/JVN96681653/index.html | third-party-advisoryx_refsource_JVN |
| https://www.wireshark.org/news/20161214.html | x_refsource_CONFIRM |
| https://github.com/vslavik/winsparkle/commit/bb45… | x_refsource_CONFIRM |
| https://jvn.jp/en/jp/JVN90813656/index.html | third-party-advisoryx_refsource_JVN |
| http://www.securityfocus.com/bid/95099 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WinSparkle | WinSparkle |
Affected:
versions prior to 0.5.3
|
Date Public
2016-12-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:04:56.130Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#96681653",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN96681653/index.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wireshark.org/news/20161214.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913"
},
{
"name": "JVN#90813656",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN90813656/index.html"
},
{
"name": "95099",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95099"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WinSparkle",
"vendor": "WinSparkle",
"versions": [
{
"status": "affected",
"version": "versions prior to 0.5.3"
}
]
}
],
"datePublic": "2016-12-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Untrusted search path vulnerability",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-12T09:57:01.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#96681653",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "https://jvn.jp/en/jp/JVN96681653/index.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wireshark.org/news/20161214.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913"
},
{
"name": "JVN#90813656",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "https://jvn.jp/en/jp/JVN90813656/index.html"
},
{
"name": "95099",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95099"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2016-7838",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "WinSparkle",
"version": {
"version_data": [
{
"version_value": "versions prior to 0.5.3"
}
]
}
}
]
},
"vendor_name": "WinSparkle"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#96681653",
"refsource": "JVN",
"url": "https://jvn.jp/en/jp/JVN96681653/index.html"
},
{
"name": "https://www.wireshark.org/news/20161214.html",
"refsource": "CONFIRM",
"url": "https://www.wireshark.org/news/20161214.html"
},
{
"name": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913",
"refsource": "CONFIRM",
"url": "https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913"
},
{
"name": "JVN#90813656",
"refsource": "JVN",
"url": "https://jvn.jp/en/jp/JVN90813656/index.html"
},
{
"name": "95099",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95099"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2016-7838",
"datePublished": "2017-06-09T16:00:00.000Z",
"dateReserved": "2016-09-09T00:00:00.000Z",
"dateUpdated": "2024-08-06T02:04:56.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2016-000251
Vulnerability from jvndb - Published: 2016-12-26 14:45 - Updated:2018-02-16 16:00
Severity
Summary
WinSparkle issue where registry value is not validated
Details
When an application that uses WinSparkle is launched, it checks the directory used by WinSparkle for temporary files and deletes any temporary files. This directory path is specified in a registry key.
In a situation where an attacker has modified the specific registry value used by this library, and a user launches an application that uses WinSparkle, an unintended directory or file may be deleted.
Takashi Yoshikawa of Mitsui Bussan Secure Directions, Inc. reported this issue to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000251.html",
"dc:date": "2018-02-16T16:00+09:00",
"dcterms:issued": "2016-12-26T14:45+09:00",
"dcterms:modified": "2018-02-16T16:00+09:00",
"description": "When an application that uses WinSparkle is launched, it checks the directory used by WinSparkle for temporary files and deletes any temporary files. This directory path is specified in a registry key.\r\n\r\nIn a situation where an attacker has modified the specific registry value used by this library, and a user launches an application that uses WinSparkle, an unintended directory or file may be deleted.\r\n\r\nTakashi Yoshikawa of Mitsui Bussan Secure Directions, Inc. reported this issue to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000251.html",
"sec:cpe": {
"#text": "cpe:/a:winsparkle:winsparkle",
"@product": "WinSparkle",
"@vendor": "WinSparkle",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "4.0",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
"@version": "2.0"
},
{
"@score": "3.6",
"@severity": "Low",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2016-000251",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN96681653/",
"@id": "JVN#96681653",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7838",
"@id": "CVE-2016-7838",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2016-7838",
"@id": "CVE-2016-7838",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "WinSparkle issue where registry value is not validated"
}