CVE-2015-6096: Infoleak
First published: Wed Nov 11 2015(Updated: )
The XML DTD parser in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka ".NET Information Disclosure Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft .NET Framework 4 | =2.0-sp2 | |
| Microsoft .NET Framework 4 | =3.5 | |
| Microsoft .NET Framework 4 | =3.5.1 | |
| Microsoft .NET Framework 4 | =4.0 | |
| Microsoft .NET Framework 4 | =4.5 | |
| Microsoft .NET Framework 4 | =4.5.1 | |
| Microsoft .NET Framework 4 | =4.5.2 | |
| Microsoft .NET Framework 4 | =4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-6096?
CVE-2015-6096 is classified as a medium severity vulnerability that allows for information disclosure.
How do I fix CVE-2015-6096?
To mitigate CVE-2015-6096, users should update to the latest version of the Microsoft .NET Framework as recommended in the security bulletins.
What impact does CVE-2015-6096 have on affected systems?
CVE-2015-6096 can allow remote attackers to read arbitrary files on the system, potentially leading to sensitive information exposure.
Which versions of Microsoft .NET Framework are affected by CVE-2015-6096?
CVE-2015-6096 affects Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, and all versions up to 4.6.
Can CVE-2015-6096 be exploited remotely?
Yes, CVE-2015-6096 can be exploited remotely through an XML External Entity (XXE) attack.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft .net framework 4
- version/microsoft .net framework 4/2.0-sp2
- version/microsoft .net framework 4/3.5
- version/microsoft .net framework 4/3.5.1
- version/microsoft .net framework 4/4.0
- version/microsoft .net framework 4/4.5
- version/microsoft .net framework 4/4.5.1
- version/microsoft .net framework 4/4.5.2
- version/microsoft .net framework 4/4.6