CVE-2016-7838

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
WinSparkle	WinSparkle	versions prior to 0.5.3

References

http://www.securityfocus.com/bid/95099Third Party Advisory, VDB Entry
https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913Patch, Third Party Advisory
https://jvn.jp/en/jp/JVN90813656/index.htmlThird Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN96681653/index.htmlThird Party Advisory, VDB Entry
https://www.wireshark.org/news/20161214.htmlVendor Advisory
http://www.securityfocus.com/bid/95099Third Party Advisory, VDB Entry
https://github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913Patch, Third Party Advisory
https://jvn.jp/en/jp/JVN90813656/index.htmlThird Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN96681653/index.htmlThird Party Advisory, VDB Entry
https://www.wireshark.org/news/20161214.htmlVendor Advisory

Timeline

Published: Jun 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-78396.1Cross-site scripting vulnerability in Olive Blog allows remote attackers to inject arbitrary web script or HTML via the search parameter.CVE-2016-78406.1Cross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary web script or HTML via the month parameter.CVE-2016-78416.1Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter.CVE-2016-78425.5Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files CVE-2016-78435.5Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 an CVE-2016-78445.5GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template.CVE-2016-78456.5GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unau CVE-2016-78516.1Adobe Connect version 9.5.6 and earlier does not adequately validate input in the events registration module. This vulnerability could be ex CVE-2016-78529.8Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Contin CVE-2016-78539.8Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Contin CVE-2016-78549.8Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Contin CVE-2016-78558.8Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote atta