PSF-2017-11
Expat 2.2.3
No score
Expat 2.2.2 was released with multiple security fixes:
- #43: Protect against compilation without any source of high quality entropy enabled, e.g. with CMake build system
- #60: Windows with _UNICODE: Unintended use of LoadLibraryW with a non-wide string resulted in failure to load advapi32.dll and degradation in quality of used entropy when compiled with _UNICODE for Windows; you can launch existing binaries with EXPAT_ENTROPY_DEBUG=1 in the environment to inspect the quality of entropy used during runtime
- [MOX-006]: Fix non-NULL parser parameter validation in XML_Parse; resulted in NULL dereference, previously
Expat 2.2.3 contains an additional security fix: #82: CVE-2017-11742 -- Windows: Fix DLL hijacking vulnerability using Steve Holme's LoadLibrary wrapper for/of cURL
What each source reports
OSV No score
Expat 2.2.3
Expat 2.2.2 was released with multiple security fixes:
- #43: Protect against compilation without any source of high quality entropy enabled, e.g. with CMake build system
- #60: Windows with _UNICODE: Unintended use of LoadLibraryW with a non-wide string resulted in failure to load advapi32.dll and degradation in quality of used entropy when compiled with _UNICODE for Windows; you can launch existing binaries with EXPAT_ENTROPY_DEBUG=1 in the environment to inspect the quality of entropy used during runtime
- [MOX-006]: Fix non-NULL parser parameter validation in XML_Parse; resulted in NULL dereference, previously
Expat 2.2.3 contains an additional security fix: #82: CVE-2017-11742 -- Windows: Fix DLL hijacking vulnerability using Steve Holme's LoadLibrary wrapper for/of cURL
- Record
PSF-2017-11- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
PSF-2017-11 is a vulnerability with no CVSS score yet, published July 17, 2017. No source lists public exploit code. No source names a fixed version.