CVE-2017-11742
published 2017-07-30CVE-2017-11742: The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan…
PriorityP433high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.47%
37.9th percentile
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | expat | — | — |
| debian | libxmltok | — | — |
| libexpat_project | libexpat | — | — |
| libexpat_project | libexpat | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat8.8HIGH
vendor_debian7.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cgjh-mqgp-mv76: The writeRandomBytes_RtlGenRandom function in xmlparse
ghsa_unreviewed·2022-05-17
CVE-2017-11742 [HIGH] CWE-426 GHSA-cgjh-mqgp-mv76: The writeRandomBytes_RtlGenRandom function in xmlparse
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.
Red Hat
xen: bad continuation handling in GNTTABOP_copy (XSA-318)
vendor_redhat·2020-04-14·CVSS 8.8
CVE-2020-11742 [HIGH] CWE-393 xen: bad continuation handling in GNTTABOP_copy (XSA-318)
xen: bad continuation handling in GNTTABOP_copy (XSA-318)
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller without any action taken. In particular, the status fields of individual operations are left uninitialised, and may result in errant behaviour in the caller of GNTTABOP_copy. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to copy a grant, it hits the incorrect exit path. This returns success to the caller without d
Debian
CVE-2017-11742: expat - The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2....
vendor_debian·2017·CVSS 7.8
CVE-2017-11742 [HIGH] CVE-2017-11742: expat - The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2....
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
2017-07-30
Published