Improper input validation in Microsoft .Net Framework
CVE-2011-0664
Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validate arguments to unspecified networking API functions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Array Offset Vulnerability."
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.160 (96.6th percentile) — read the EPSS interpretation.
Affected products
- Microsoft .Net_framework — versions 4.0, 3.5.1, 2.0
- Microsoft Silverlight — versions 4.0.60310.0
- Microsoft Windows_2003_server
- Microsoft Windows_7
- Microsoft Windows_server_2003
- Microsoft Windows_server_2008 — versions r2
- Microsoft Windows_vista
- Microsoft Windows_xp
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)