← Back

CVE-2013-0001

nvd nist
Published: Jan 9, 2013Modified: Apr 29, 2026

JSON object

Loading...
4.3
Vector
AV:N/AC:M/Au:N/C:P/I:N/A:N
Exploitability: 8.6 / Impact: 2.9
Source: NVD

Description

The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a pointer to an unmanaged memory location, aka "System Drawing Information Disclosure Vulnerability."

Affected (7)

Microsoft
1 product
.net Framework
Configuration A
1 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
.net Framework
Version 1.0 sp3
Running on/withPlatform Versions
Microsoft
Windows Xp
All versions
Microsoft
Windows Xp
All versions
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
.net Framework
Version 1.1 sp1
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
.net Framework
Version 2.0 sp2
Configuration D
1 vulnerable · 6 platform
Vulnerable SoftwareAffected Versions
.net Framework
Version 4.0
Running on/withPlatform Versions
Microsoft
Windows Server 2003
All versions
Microsoft
Windows Server 2008
All versions
Microsoft
Windows Server 2008
All versions
Microsoft
Windows Server 2008
All versions
Microsoft
Windows Xp
All versions
Microsoft
Windows Xp
All versions
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
.net Framework
Version 3.5
Configuration F
1 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
.net Framework
Version 3.5.1
Running on/withPlatform Versions
Microsoft
Windows 7
All versions
Microsoft
Windows Server 2008
All versions
Microsoft
Windows Server 2008
All versions
Configuration G
1 vulnerable · 8 platform
Vulnerable SoftwareAffected Versions
.net Framework
Version 4.5
Running on/withPlatform Versions
Microsoft
Windows 7
All versions
Microsoft
Windows 7
All versions
Microsoft
Windows 8
All versions
Microsoft
Windows 8
All versions
Microsoft
Windows Rt
All versions
Microsoft
Windows Server 2012
All versions
Microsoft
Windows Vista
All versions
Microsoft
Windows Vista
All versions

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

Source: secure@microsoft.com
Source: secure@microsoft.com
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.