JVN#96681653: WinSparkle issue where registry value is not validated

When an application that uses WinSparkle is launched, it checks the directory used by WinSparkle for temporary files and deletes any temporary files. This directory path is specified in a registry key.

In a situation where an attacker has modified the specific registry value used by this library, and a user launches an application that uses WinSparkle, an unintended directory or file may be deleted.

Impact

Effects vary depending on the application. An arbitrary directory or file may be deleted with the privileges of the application.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

Products Affected

• Applications that use WinSparkle versions prior to 0.5.3
  Wireshark version 2.0.5 has been reported to be affected by this issue. Applications other than Wireshark may also be affected.