CVE-2016-7063

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privilege escalation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	pritunl-client-electron	1.0.1116.6

References

https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6Release Notes, Third Party Advisory
https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6%2C
https://lf.lc/CVE-2016-7063.txtExploit, Third Party Advisory
https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6Release Notes, Third Party Advisory
https://github.com/pritunl/pritunl-client-electron/releases/tag/1.0.1116.6%2C
https://lf.lc/CVE-2016-7063.txtExploit, Third Party Advisory

Timeline

Published: Jul 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70647.5A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage CVE-2016-70658.8The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of servic CVE-2016-70667.8It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow an CVE-2016-70676.5Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable CVE-2016-70687.5An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticate CVE-2016-70697.5An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist CVE-2016-70708.0A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures CVE-2016-70718.8It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote CVE-2016-70727.5An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a deni CVE-2016-70735.9An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-CVE-2016-70745.9An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-CVE-2016-70758.1It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fi