CVE-2017-2248

CVE-2017-2248 affects Lhaz+ installers (version 3.4.0 and earlier). The root cause is an untrusted search path leading to insecure loading of a Trojan horse DLL (CWE-427), enabling arbitrary code execution with the user’s privileges during installation. Public sources in CNVD/JVN indicate the vul...

CVE-2017-2253

CVE-2017-2253 describes an untrusted DLL search path flaw in the Yahoo! Toolbar installer for Internet Explorer (version 8.0.0.6 and earlier). The root cause is insecure DLL loading (CWE-427) via the installer, which can allow arbitrary code execution with the invoking user’s privileges. Public s...

CVE-2017-2267

Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2272

Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.3.2.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2252

Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6.02 and earlier, Ver.7 version 7.02 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2246

Untrusted search path vulnerability in Installer of Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2252

This CVE affects File Compact self-extracting archives: vulnerable in Ver.5 up to 5.10, Ver.6 up to 6.02, and Ver.7 up to 7.02. Root cause is insecure DLL search path (CWE-427) allowing arbitrary code execution with the user’s privileges. Affected products should be updated to non-affected releas...

CVE-2017-2247

CVE-2017-2247 concerns Lhaz self-extracting archive files created by Lhaz 2.4.0 and earlier. The vulnerability is an untrusted search path that can be exploited to gain privileges via a Trojan horse DLL located in an unspecified directory. Documents indicate that self-extracting archives and inst...

CVE-2017-2269

The CVE-2017-2269 issue affects FileCapsule Deluxe Portable Ver.2.0.9 and earlier, described as an untrusted search path vulnerability where a Trojan DLL in an unspecified directory can be loaded to gain privileges. Multiple connected sources indicate this could allow arbitrary code execution wit...

CVE-2017-2271

CVE-2017-2271 concerns an untrusted search path vulnerability in AttacheCase, affecting self-extracting encrypted files created by AttacheCase versions 2.8.3.0 and earlier. The root cause is insecure loading of Dynamic Link Libraries (DLLs) via a Trojan horse DLL in an unspecified directory, enab...

CVE-2017-2267

Consolidated data confirms CVE-2017-2267 affects FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier and is an untrusted search path vulnerability (CWE-427) where a Trojan horse DLL in an unspecified directory can be loaded to escalate privileges. Affected component is the DLL loading mechanism o...

CVE-2017-2270

Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.2.0.9 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2247

Untrusted search path vulnerability in Self-extracting archive files created by Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2248

Untrusted search path vulnerability in Installer of Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2266

CVE-2017-2266 concerns FileCapsule Deluxe Portable and its Encrypted Files in Self-Decryption Format. The vulnerability is an untrusted search path that could allow arbitrary code execution via a Trojan horse DLL loaded from an unspecified directory, with impact as described in the CVE records. A...

CVE-2017-2272

AttacheCase self-extracting encrypted files are affected by an untrusted DLL search path (CWE-427) vulnerability. Versions up to 3.2.2.6 are vulnerable; exploitation allows arbitrary code execution via a Trojan DLL loaded from an untrusted directory. Affected products include AttacheCase with CVE...

CVE-2017-2249

Untrusted search path vulnerability in Self-extracting archive files created by Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2246

The CVE-2017-2246 entry concerns Lhaz Installer (version 2.4.0 and earlier). The vulnerability is an untrusted search path that allows an attacker to gain privileges by placing a Trojan DLL in an unspecified directory, enabling arbitrary code execution with the invoking user’s privileges via the ...

Self-Extracting Encrypted Files created by AttacheCase may insecurely load Dynamic Link Libraries

Overview AttacheCase is an open source file encryption software provided by HiBARA Software. It can also create self-extracting encrypted files. Self-extracting encrypted files created by AttacheCase contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link...

Electronic tendering and bid opening system driver untrusted search path vulnerability

Electronic tendering and bid opening system is a tendering and bidding system of Japan Defense Equipment Agency DEA.Installer is one of the installation programs. An untrusted search path vulnerability exists in the Electronic tendering and bid opening system installer. The vulnerability can be...