Approved changes feed: RSS · Atom
cpe:2.3:a:wixtoolset_project:burn:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Wixtoolset Project (99345bc1-d0df-520c-a352-be699cec748f) |
|---|---|
| Product | Burn (2296e899-64b8-58f4-906a-0e21ae49a185) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-29187 |
vulnerable | 2026-06-08 06:33:28.932120 |
WiX based installers are vulnerable to binary hijack when run as SYSTEM
HIGH (7.3)
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
Published: 2024-03-24T19:38:38.140Z
Updated: 2024-08-13T14:28:49.838Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.