CVE-2016-2542
highPriorität · verfolgen · 31EPSS 0.005 · 43. PerzentilEUJPRUUSEPSS · bewertet 2026-10-27
Untrusted search path vulnerability in Flexera InstallShield through 2015 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory of a setup-launcher executable file.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenFlexera InstallShieldcisa_csaf_ot
It is recommended that users contact the product's vendor support team for guidance on any mitigations and workarounds regarding Flexera InstallShield issues in relation to that product.
- BehobenMitsubishi Electric Numerical Control Device Communication Software (FCSB1224)cisa_csaf_ot
Please download and install the fixed version from the Mitsubishi Electric download site: Mitsubishi Electric Numerical Control Device Communication Software (FCSB1224): "A9" or later https://www.mitsubishielectric.com/fa/download/index.html.
- BehobenNC Trainer2cisa_csaf_ot
Please download and install the fixed version from the Mitsubishi Electric download site: NC Trainer2: "AC" or later https://www.mitsubishielectric.com/fa/download/index.html.
- BehobenNC Trainer2 pluscisa_csaf_ot
Please download and install the fixed version from the Mitsubishi Electric download site: NC Trainer2 plus: "AC" or later https://www.mitsubishielectric.com/fa/download/index.html.
- BehobenNC Virtual Simulatorcisa_csaf_ot
Please download and install the fixed version from the Mitsubishi Electric download site: NC Virtual Simulator: "A5" or later https://www.mitsubishielectric.com/fa/download/index.html.
- MitigationFlexera InstallShieldcisa_csaf_ot
For more information see Flexera's KBR-Article.
https://community.flexera.com/t5/InstallShield-Knowledge-Base/Windows-loads-a-different-library-or-launches-a-different/ta-p/4739 - MitigationAVEVA Edge 2020cisa_csaf_ot
AVEVA recommends organizations evaluate the impact of these vulnerabilities based on operational environment, architecture, and product implementations.
- MitigationMS Configuratorcisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationMitsubishi Electric CNC communication software runtime library M70LC cisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationMitsubishi Electric CNC communication software runtime library M730LCcisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationMitsubishi Electric Numerical Control Device Communication Software (FCSB1224)cisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Analyzercisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Analyzer2cisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Configurator2cisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Designercisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Designer2cisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Explorercisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Monitorcisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Monitor2cisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Trainercisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Trainer pluscisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Trainer2cisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Trainer2 pluscisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Virtual Simulatorcisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationNC Visualizercisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
- MitigationRemote Monitor Toolcisa_csaf_ot
Before running the setup-launcher, make sure that no DLL exists in the folder containing the setup-launcher executable file (the name varies depending on the product) for the product.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (43)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-20-287-03Flexera InstallShield2020-10-13icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow execution of a malicious DLL.
- ICSA-22-326-01AVEVA Edge2022-11-22icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to insert malicious DLL files and trick the application into executing code.
- ICSA-25-205-01Mitsubishi Electric CNC Series (Update B)2025-07-24icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow a local attacker to execute malicious code by getting setup-launcher to load a malicious DLL.
- JVNDB-2026-001732JVN iPedia advisory JVNDB-2026-0017322026-01-26vendor · jvndbJP
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (20)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.securitytracker.com/id/1035097cnnvd
- https://flexeracommunity.force.com/customer/articles/INFO/Best-Practices-to-Avoid-Windows-Setup-Launcher-Executable-Issuescnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-287-03cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.3529/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.6114.2cnnvd
- https://www.oracle.com/security-alerts/cpuApr2021.htmlcnnvd
- https://www.securityfocus.com/bid/84213cnnvd
- https://www.tenable.com/security/tns-2019-08cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan