CVE-2012-1855 : Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handl

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Memory Access Vulnerability."

Published 2012-06-12 22:55:01

Updated 2025-04-11 00:51:22

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2012-1855

Microsoft » .net Framework » Version: 2.0 Update SP2
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows 2003 Server » Update SP2 Itanium Edition
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X86 Edition
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » .net Framework » Version: 3.5.1
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » X64 Edition
When used together with: Microsoft » Windows 7 » X86 Edition
When used together with: Microsoft » Windows 7 » Update SP1 X86 Edition
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X86 Edition
When used together with: Microsoft » Windows Server 2008 » Version: R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Version: R2 X64 Edition
Microsoft » .net Framework » Version: 4.0
cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows 7 » X86 Edition
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X64 Edition
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X86 Edition
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Update R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X86 Edition
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition

Exploit prediction scoring system (EPSS) score for CVE-2012-1855

EPSS FAQ

47.53%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-1855

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2012-1855

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-1855

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14717

Repository / Oval Repository
http://www.us-cert.gov/cas/techalerts/TA12-164A.html

Microsoft Updates for Multiple Vulnerabilities | CISA
US Government Resource

CVEs referencing this url
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-038

Microsoft Security Bulletin MS12-038 - Critical | Microsoft Docs

Jump to

Vulnerability Details : CVE-2012-1855

Products affected by CVE-2012-1855

Exploit prediction scoring system (EPSS) score for CVE-2012-1855

CVSS scores for CVE-2012-1855

CWE ids for CVE-2012-1855

References for CVE-2012-1855