CVE-2012-1855

EPSS 50.26%
Published 12.06.2012 22:55:01
Last modified 11.04.2025 00:51:21
Source secure@microsoft.com
Teams watchlist Login
Open Login

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Memory Access Vulnerability."

Affected products Warnungen 0 Metrics 2 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ .Net Framework Version2.0 Updatesp2

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows 2003 Server Updatesp2 Editionitanium
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx86
   Microsoft ≫ Windows Server 2008 Version- Updatesp2 Editionitanium
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Vista Version- Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ .Net Framework Version3.5.1

   Microsoft ≫ Windows 7 Editionx64
   Microsoft ≫ Windows 7 Editionx86
   Microsoft ≫ Windows 7 Updatesp1 Editionx86
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2008 Versionr2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionx64

Microsoft ≫ .Net Framework Version4.0

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows 7 Editionx86
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx64
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Updater2 Editionitanium
   Microsoft ≫ Windows Server 2008 Updater2 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx86
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	50.26%	0.978

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://www.us-cert.gov/cas/techalerts/TA12-164A.html

US Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-038

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14717

https://nvd.nist.gov/vuln/detail/CVE-2012-1855

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2012-1855

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2012-1855

EUVD