CVE-2009-0090
high · 9.3Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory, and execute arbitrary code, via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Pointer Verification Vulnerability."
9.3
CVSS
21.0%
EPSS (exploit prob.)
97th
EPSS percentile
2009-10-14
Published
AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-264
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | windows_2000 | all versions |
| microsoft | .net_framework | 1.1 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 2.0 |
| microsoft | windows_server_2003 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | .net_framework | 1.1 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 3.5 |
| microsoft | .net_framework | 3.5 |
| microsoft | windows_vista | all versions |
| microsoft | windows_vista | all versions |
| microsoft | windows_vista | all versions |
| microsoft | windows_vista | all versions |
| microsoft | .net_framework | 1.1 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 3.5 |
| microsoft | .net_framework | 3.5 |
| microsoft | .net_framework | 1.1 |
| microsoft | windows_7 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | windows_server_2008 | all versions |
| microsoft | .net_framework | 1.0 |
| microsoft | .net_framework | 1.1 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 2.0 |
| microsoft | .net_framework | 3.5 |
| microsoft | .net_framework | 3.5 |
| microsoft | windows_xp | all versions |
| microsoft | windows_xp | all versions |
| microsoft | windows_xp | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://www.us-cert.gov/cas/techalerts/TA09-286A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5716
- http://www.us-cert.gov/cas/techalerts/TA09-286A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5716
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2009-0090