CVE-2024-29187

CVE-2024-29187 affects Wix Burn-based bundles when run as SYSTEM. Burn drops binaries into the insecure C:\Windows\Temp via GetTempPathW, allowing an attacker to hijack the binaries and elevate privileges. The issue is fixed in Wix 3.14.1 and 4.0.5. Affected component: Wix Toolset Burn installer ...

CVE-2024-29187 WiX based installers are vulnerable to binary hijack when run as SYSTEM

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it'...

PT-2024-4137 · Unknown · Wix Toolset

Name of the Vulnerable Software and Affected Versions: WiX Toolset versions prior to 3.14.1 WiX Toolset versions prior to 4.0.5 Description: The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire...

PT-2024-4138

Name of the Vulnerable Software and Affected Versions: WiX Toolset versions prior to 3.14.1 WiX Toolset versions prior to 4.0.5 Description: The WiX toolset has a vulnerability related to the use of the GetTempPathW function, which points to an insecure directory C:WindowsTemp to drop and load...

WiX Toolset 安全漏洞

WiX Toolset is an open source code library for . A security vulnerability exists in WiX Toolset that stems from a malicious directory connection that could cause WiX RemoveFoldersEx to delete elevated files...

WiX Toolset 安全漏洞

WiX Toolset is an open source code library for . A security vulnerability exists in WiX Toolset that originates from a standard user being able to hijack a binary before it is loaded into an application, resulting in elevated privileges...

Wix Toolset Installed (Windows)

Binary data wixwininstalled.nbin...

Wix Toolset < 3.14 / 4.x < 4.0.4 Privilege Escalation

The version of Wix Toolset installed on the remote host is prior to 3.14.0 or 4.x prior to 4.0.4. It is, therefore, affected by a privilege escalation vulnerability. The .be TEMP folder is vulnerable to DLL redirection attacks that allow an unauthenticated, local attacker to escalate privileges...

WiX Toolset's .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

Summary .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. Details If the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its o...

GHSA-7WH2-WXC7-9PH5 WiX Toolset's .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

Summary .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. Details If the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its o...

CVE-2024-24810

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been...

Code injection

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been...

CVE-2024-24810

The CVE-2024-24810 entry concerns the Wix Toolset used to build Windows Installer packages. The vulnerability resides in the.be TEMP folder, enabling DLL redirection that can permit a local attacker to escalate privileges during installation. Affected component is the WiX installer framework; imp...

CVE-2024-24810 WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been...

WiX Toolset Code Issue Vulnerability

WiX Toolset is an open source code library for . A code issue vulnerability exists in WiX Toolset 4 through 4.0.4, versions prior to 3.14.0, which stems from the .be TEMP folder being susceptible to a DLL redirection attack that allows an attacker to elevate privileges...

CVE-2020-18169

A vulnerability in the Windows installer XML WiX toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit installer would require the end user to ignore other safety mechanisms provided by the Host OS. See reference document for more details...

Design/Logic Flaw

A vulnerability in the Windows installer XML WiX toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit installer would require the end user to ignore other safety mechanisms provided by the Host OS. See reference document for more details...

CVE-2020-18169

TechSmith Snagit version 19.1.1.2860 is affected by a privilege-escalation issue in the Windows installer XML (WiX) toolset. The vulnerability is described as enabling elevation of privileges via the Snagit installer, with the caveat that exploitation requires the user to bypass other OS safety m...

CVE-2019-16511

An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file even with a ../ sequence is...

CVE-2019-16511

An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file even with a ../ sequence is...