CVE-2018-0764 Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
HighCVSS 7.5
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget System.Security.Cryptography.Xml(NuGet) | < 4.4.2 | 4.4.2 |
| nuget System.Security.Cryptography.Xml(NuGet) | = 4.4.0 | No fix listed |
| nuget System.Security.Cryptography.Xml(NuGet) | = 4.4.0-preview1-25305-02 | No fix listed |
| nuget System.Security.Cryptography.Xml(NuGet) | = 4.4.0-preview2-25405-01 | No fix listed |
| nuget System.Security.Cryptography.Xml(NuGet) | = 4.4.1 | No fix listed |
| Microsoft net core | = 1.0 | No fix listed |
| Microsoft net core | = 1.1 | No fix listed |
| Microsoft net core | = 2.0 | No fix listed |
| Microsoft powershell core | = 6.0 | No fix listed |
| Microsoft net framework | = 2.0-sp2 | No fix listed |
| Microsoft net framework | = 3.0-sp2 | No fix listed |
| Microsoft net framework | = 3.5 | No fix listed |
| Microsoft net framework | = 3.5.1 | No fix listed |
| Microsoft net framework | = 4.5.2 | No fix listed |
| Microsoft net framework | = 4.6 | No fix listed |
| Microsoft net framework | = 4.6.1 | No fix listed |
| Microsoft net framework | = 4.6.2 | No fix listed |
| Microsoft net framework | = 4.7 | No fix listed |
| Microsoft net framework | = 4.7.1 | No fix listed |
| Microsoft .NET Framework and .NET Core | = Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2018:0379 third-party-advisory vendor-advisory
- github.com vendor-advisory
- portal.msrc.microsoft.com patch vendor-advisory
- 102387 third-party-advisory vdb-entry
- 1040152 third-party-advisory vdb-entry