Improper input validation in Microsoft .Net Framework

CVE-2013-0004

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.214 (97.4th percentile) — read the EPSS interpretation.

Affected products

Microsoft .Net_framework — versions 1.0, 1.1, 2.0
Microsoft Windows_7
Microsoft Windows_8
Microsoft Windows_rt
Microsoft Windows_server_2003
Microsoft Windows_server_2008
Microsoft Windows_server_2012
Microsoft Windows_vista
Microsoft Windows_xp
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)
secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
secure@microsoft.com (x_refsource_MS, vendor-advisory)