CVE-2017-11742

The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2017-07-30

Last modified

2024-08-05

Weaknesses

CWE-426

Affected products

• Libexpat (Libexpat Project)

References

• http://www.securityfocus.com/bid/100147
• https://github.com/libexpat/libexpat/issues/82