Buffer overflow in Microsoft .Net Framework

CVE-2013-0002

Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages improper counting of objects during a memory copy operation, aka "WinForms Buffer Overflow Vulnerability."

Vulnerability class: Buffer Overflow

EPSS: 0.251 (97.7th percentile) — read the EPSS interpretation.

Affected products

Microsoft .Net_framework — versions 1.0, 1.1, 2.0
Microsoft Windows_7
Microsoft Windows_8
Microsoft Windows_rt
Microsoft Windows_server_2003
Microsoft Windows_server_2008
Microsoft Windows_server_2012
Microsoft Windows_vista
Microsoft Windows_xp
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)
secure@microsoft.com (x_refsource_MS, vendor-advisory)
secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
secure@microsoft.com (mailing-list, x_refsource_MLIST)