CVE-2013-0001

Description

The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a pointer to an unmanaged memory location, aka "System Drawing Information Disclosure Vulnerability."

Related CPE's

amicrosoft.net_framework1.0sp3******

omicrosoftwindows_xp-sp3media_center*****

omicrosoftwindows_xp-sp3tablet_pc*****

amicrosoft.net_framework1.1sp1******

omicrosoftwindows_server_2008*sp2x86*****

omicrosoftwindows_vista*sp2x64*****

omicrosoftwindows_server_2008-sp2itanium*****

omicrosoftwindows_xp-sp2x64*****

omicrosoftwindows_xp*sp3******

omicrosoftwindows_server_2008*sp2x64*****

References

oval:org.mitre.oval:def:15814

MS13-004

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version

2.0

VectorString

AV:N/AC:M/Au:N/C:P/I:N/A:N

AccessVector

NETWORK

AccessComplexity

MEDIUM

Authentication

NONE

ConfidentialityImpact

PARTIAL

IntegrityImpact

NONE

AvailabilityImpact

NONE

BaseScore

4.300000190734863

Created by Yello
About Severity.io