| Vulnerability Name: | CVE-2015-2504 (CCN-106051) | ||||||||
| Assigned: | 2015-09-08 | ||||||||
| Published: | 2015-09-08 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute arbitrary code via a crafted XAML browser application (XBAP) or (2) bypass Code Access Security restrictions via a crafted .NET Framework application, aka ".NET Elevation of Privilege Vulnerability." | ||||||||
| CVSS v3 Severity: | 8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
| ||||||||
| Vulnerability Type: | CWE-119 | ||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||
| References: | Source: MITRE Type: CNA CVE-2015-2504 Source: CCN Type: Microsoft Security Bulletin MS15-101 Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (3089662) Source: BID Type: UNKNOWN 76560 Source: SECTRACK Type: UNKNOWN 1033493 Source: MS Type: UNKNOWN MS15-101 Source: XF Type: UNKNOWN ms-dotnet-cve20152504-priv-esc(106051) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||