{"id":"PSF-2017-11","aliases":[],"status":"published","title":"Expat 2.2.3","description":"Expat 2.2.2 was released with multiple security fixes:\n\n* #43: Protect against compilation without any source of high quality\n  entropy enabled, e.g. with CMake build system\n* #60: Windows with _UNICODE: Unintended use of LoadLibraryW with a non-wide\n  string resulted in failure to load advapi32.dll and degradation in quality\n  of used entropy when compiled with _UNICODE for Windows; you can launch\n  existing binaries with EXPAT_ENTROPY_DEBUG=1 in the environment to inspect\n  the quality of entropy used during runtime\n* [MOX-006]: Fix non-NULL parser parameter validation in XML_Parse; resulted\n  in NULL dereference, previously\n\nExpat 2.2.3 contains an additional security fix: #82: CVE-2017-11742 --\nWindows: Fix DLL hijacking vulnerability using Steve Holme's LoadLibrary\nwrapper for/of cURL","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2017-07-17T00:00:00Z","modified":"2025-10-09T01:01:18Z","references":[{"url":"https://bugs.python.org/issue30947","tags":["report"]}],"sources":{"osv":[{"id":"PSF-2017-11","title":"Expat 2.2.3","description":"Expat 2.2.2 was released with multiple security fixes:\n\n* #43: Protect against compilation without any source of high quality\n  entropy enabled, e.g. with CMake build system\n* #60: Windows with _UNICODE: Unintended use of LoadLibraryW with a non-wide\n  string resulted in failure to load advapi32.dll and degradation in quality\n  of used entropy when compiled with _UNICODE for Windows; you can launch\n  existing binaries with EXPAT_ENTROPY_DEBUG=1 in the environment to inspect\n  the quality of entropy used during runtime\n* [MOX-006]: Fix non-NULL parser parameter validation in XML_Parse; resulted\n  in NULL dereference, previously\n\nExpat 2.2.3 contains an additional security fix: #82: CVE-2017-11742 --\nWindows: Fix DLL hijacking vulnerability using Steve Holme's LoadLibrary\nwrapper for/of cURL\n","status":"published","published":"2017-07-17T00:00:00Z","modified":"2025-10-09T01:01:18.456128Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}