CVE-2016-5720

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) msi.dll, (2) dpapi.dll, or (3) cryptui.dll that is located in the current working directory.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2016/Sep/65Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/95859
http://seclists.org/fulldisclosure/2016/Sep/65Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/95859

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-57216.1Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web scri CVE-2016-57227.3Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in CVE-2016-57237.8Huawei FusionInsight HD before V100R002C60SPC200 allows local users to gain root privileges via unspecified vectors.CVE-2016-57247.5Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.CVE-2016-57255.9Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP server CVE-2016-57269.8Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP co CVE-2016-57278.8LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP co CVE-2016-57286.3Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows CVE-2016-57298.2Lenovo BIOS EFI Driver allows local administrators to execute arbitrary code with System Management Mode (SMM) privileges via unspecified ve CVE-2016-57305.3phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via CVE-2016-57316.1Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x befor CVE-2016-57326.1Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.ph