CVE-2014-1806: Code Injection

Published May 14, 2014

Updated

The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, which allows remote attackers to execute arbitrary code via vectors involving malformed objects, aka "TypeFilterLevel Vulnerability."

Affected Software

7 affected components

Microsoft .NET Framework=1.1-sp1

Microsoft .NET Framework=2.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Microsoft .NET Framework=4.5.1

Event History

May 14, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

via NVD·11:13 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-1806?

CVE-2014-1806 has a high severity rating due to its potential for remote code execution.

How do I fix CVE-2014-1806?

To fix CVE-2014-1806, update your Microsoft .NET Framework to the latest supported version.

What versions of .NET Framework are affected by CVE-2014-1806?

CVE-2014-1806 affects Microsoft .NET Framework versions 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4.0, 4.5, and 4.5.1.

What type of attack does CVE-2014-1806 allow?

CVE-2014-1806 allows remote attackers to execute arbitrary code by exploiting memory access vulnerabilities.

Is CVE-2014-1806 a critical vulnerability?

Yes, CVE-2014-1806 is considered critical due to its ability to facilitate remote code execution.