Skip to content
OpenAdvisories
Unscored CVE-2020-3979 EUVD-2020-25244GHSA-6495-758p-crj2

InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writ…

Published Sep 18, 2020 · Updated Aug 4, 2024 · Assigned by vmware

Description

InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writable by non-admin users. While those plugins are not required, they are loaded if present, which could allow an attacker to plant a malicious library which could result in code execution with the security scope of the installer.

Affected products

VendorProductAffectedFixed
— VMware InstallBuilder All InstallBuilder for Qt versions prior to version 20.7.0 —

References