VulnerabilityModified
CVE-2014-4062
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows remote attackers to obtain sensitive address information via a crafted web site, aka ".NET ASLR Vulnerability."
MEDIUM 4.3EPSS 14.3%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows remote attackers to obtain sensitive address information via a crafted web site, aka ".NET ASLR Vulnerability."
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 14.26% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- microsoft/.net framework
- Source
- secure@microsoft.com
References
- http://www.securityfocus.com/bid/69145
- http://www.securitytracker.com/id/1030721
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-046
- http://www.securityfocus.com/bid/69145
- http://www.securitytracker.com/id/1030721
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-046
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.