CVEvulnerability
CVE-2009-0090
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-10-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory, and execute arbitrary code, via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Pointer Verification Vulnerability."
Affected configurations
• microsoft windows 2000
• microsoft .net framework 1.1
• microsoft .net framework 2.0
• microsoft windows server 2003
• microsoft windows server 2008
• microsoft .net framework 3.5
• microsoft windows vista
• microsoft windows 7
• microsoft .net framework 1.0
• microsoft windows xp
Related
Weakness · not in database (1)
References
- http://www.us-cert.gov/cas/techalerts/TA09-286A.html US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5716 oval.cisecurity.org
- http://www.us-cert.gov/cas/techalerts/TA09-286A.html US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5716 oval.cisecurity.org