VMware Installbuilder vulnerabilities

3 CVEs affecting VMware Installbuilder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22038, published 2021-10-29.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-3946, published 2020-04-20. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).
• CVE-2021-22038, published 2021-10-29. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not block the installation directory). This…
• CVE-2021-22037, published 2021-10-29. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the…