CVE-2014-0295: microsoft .net_framework

Vulnerability summary

CVE-2014-0295 is a medium (CVSS 4.3) vulnerability in microsoft .net_framework. EPSS estimates a 13.77% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-02-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in February 2014, aka "VSAVB7RT ASLR Vulnerability."

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.