CVE-2013-0004 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary....
HighCVSS 9.3
EPSS 21.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft net framework | = 1.0-sp3 | No fix listed |
| Microsoft net framework | = 1.1-sp1 | No fix listed |
| Microsoft net framework | = 2.0-sp2 | No fix listed |
| Microsoft net framework | = 4.0 | No fix listed |
| Microsoft net framework | = 3.5 | No fix listed |
| Microsoft net framework | = 3.5.1 | No fix listed |
| Microsoft net framework | = 4.5 | No fix listed |
References
- TA13-008A third-party-advisory us-government-resource
- MS13-004 vendor-advisory
- oval:org.mitre.oval:def:16339 signature vdb-entry