9.3

CVE-2011-0664

Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validate arguments to unspecified networking API functions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Array Offset Vulnerability."

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ .Net Framework Version4.0
   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx32
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Version- Updatesp2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionx64
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64
Microsoft ≫ .Net Framework Version3.5.1
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionx64
Microsoft ≫ .Net Framework Version2.0 Updatesp2
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx32
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Version- Updatesp2 Editionitanium
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64
Microsoft ≫ .Net Framework Version3.5 Updatesp1
   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx32
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Version- Updatesp2 Editionitanium
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64
Microsoft ≫ .Net Framework Version2.0 Updatesp1
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Vista Updatesp1
Microsoft ≫ .Net Framework Version3.5
   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64
Microsoft ≫ Silverlight Version4.0.60310.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 11.19% 0.933
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.