Vulnerability in Microsoft .Net Framework

CVE-2014-4062

Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows remote attackers to obtain sensitive address information via a crafted web site, aka ".NET ASLR Vulnerability."

EPSS: 0.143 (96.2th percentile) — read the EPSS interpretation.

Affected products

Microsoft .Net_framework — versions 1.1, 2.0, 3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

secure@microsoft.com (vdb-entry, x_refsource_SECTRACK)
secure@microsoft.com (vdb-entry, x_refsource_BID)
secure@microsoft.com (x_refsource_MS, vendor-advisory)