Full Disclosure

Executable installers are vulnerable^WEVIL (case 25): WinRAR's installer and self-extractors allow arbitrary (remote) code execution and escalation of privilege

Posted by Stefan Kanthak on Feb 10

Hi @ll,

the executable installers of WinRAR 5.30 and earlier versions
as well as ALL self-extracting archives created with them
load and execute UXTheme.dll, RichEd32.dll and RichEd20.dll
from their “application directory”.

For software downloaded with a web browser the application
directory is typically the user’s “Downloads” directory: see
<…