Firegiant Wix Toolset vulnerabilities

2 known vulnerabilities affecting firegiant/wix_toolset.

Total CVEs

2

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2024-24810HIGHCVSS 7.8fixed in 3.14.0≥ 4.0.0, < 4.0.42024-02-07

CVE-2024-24810 [HIGH] CWE-426 CVE-2024-24810: WiX toolset lets developers create installers for Windows Installer, the Windows installation engine WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4.

CVE-2019-16511MEDIUMCVSS 5.5fixed in 3.11.22019-09-19

CVE-2019-16511 [MEDIUM] CWE-22 CVE-2019-16511: An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compress An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file (even with a ../ sequence) is concatenated with the destination path.