Vulnerability in Microsoft .Net Framework
CVE-2014-0295
VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability."
EPSS: 0.138 (96.1th percentile) — read the EPSS interpretation.
Affected products
- Microsoft .Net_framework — versions 2.0, 3.5.1
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@microsoft.com (vdb-entry, x_refsource_SECTRACK)
- secure@microsoft.com (x_refsource_OSVDB, vdb-entry)
- secure@microsoft.com (vdb-entry, x_refsource_BID)
- secure@microsoft.com (Exploit, x_refsource_MISC)
- secure@microsoft.com (x_refsource_SECUNIA, third-party-advisory)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)