First published: Wed Jan 10 2018(Updated: )
.NET Core 1.0, 1.1 and 2.0 perform improper processing of XML documents. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET Core application. References: <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-0764">https://nvd.nist.gov/vuln/detail/CVE-2018-0764</a> <a href="https://github.com/dotnet/core/blob/master/release-notes/2.0/2.0.5.md">https://github.com/dotnet/core/blob/master/release-notes/2.0/2.0.5.md</a> <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0764">https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0764</a> <a href="https://github.com/dotnet/corefx/commit/3f1155b">https://github.com/dotnet/corefx/commit/3f1155b</a>
Credit: secure@microsoft.com secure@microsoft.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/dotnetcore | <1.0.9 | 1.0.9 |
redhat/dotnetcore | <1.1.6 | 1.1.6 |
redhat/dotnet | <2.0.5 | 2.0.5 |
Microsoft .NET Core | =1.0 | |
Microsoft .NET Core | =1.1 | |
Microsoft .NET Core | =2.0 | |
Microsoft Powershell Core | =6.0 | |
Microsoft .NET Framework | =2.0-sp2 | |
Microsoft .NET Framework | =3.0-sp2 | |
Microsoft Windows Server 2008 | =sp2 | |
Microsoft .NET Framework | =3.5 | |
Microsoft Windows 10 | ||
Microsoft Windows 10 | =1511 | |
Microsoft Windows 10 | =1607 | |
Microsoft Windows 10 | =1703 | |
Microsoft Windows 8.1 | ||
Microsoft Windows Server 2012 | ||
Microsoft Windows Server 2012 | =r2 | |
Microsoft Windows Server 2016 | ||
Microsoft .NET Framework | =3.5.1 | |
Microsoft Windows 7 | =sp1 | |
Microsoft Windows Server 2008 | =r2-sp1 | |
Microsoft Windows Server 2008 | =r2-sp1 | |
Microsoft .NET Framework | =4.5.2 | |
Microsoft Windows RT 8.1 | ||
Microsoft .NET Framework | =4.6 | |
Microsoft .NET Framework | =4.6.1 | |
Microsoft .NET Framework | =4.6.2 | |
Microsoft .NET Framework | =4.7 | |
Microsoft .NET Framework | =4.7.1 | |
Microsoft Windows 10 | =1709 | |
All of | ||
Any of | ||
Microsoft .NET Framework | =2.0-sp2 | |
Microsoft .NET Framework | =3.0-sp2 | |
Microsoft Windows Server 2008 | =sp2 | |
All of | ||
Microsoft .NET Framework | =3.5 | |
Any of | ||
Microsoft Windows 10 | ||
Microsoft Windows 10 | =1511 | |
Microsoft Windows 10 | =1607 | |
Microsoft Windows 10 | =1703 | |
Microsoft Windows 8.1 | ||
Microsoft Windows Server 2012 | ||
Microsoft Windows Server 2012 | =r2 | |
Microsoft Windows Server 2016 | ||
All of | ||
Microsoft .NET Framework | =3.5.1 | |
Any of | ||
Microsoft Windows 7 | =sp1 | |
Microsoft Windows Server 2008 | =r2-sp1 | |
Microsoft Windows Server 2008 | =r2-sp1 | |
All of | ||
Microsoft .NET Framework | =4.5.2 | |
Any of | ||
Microsoft Windows 7 | =sp1 | |
Microsoft Windows 8.1 | ||
Microsoft Windows RT 8.1 | ||
Microsoft Windows Server 2008 | =sp2 | |
Microsoft Windows Server 2008 | =r2-sp1 | |
Microsoft Windows Server 2012 | ||
Microsoft Windows Server 2012 | =r2 | |
All of | ||
Microsoft .NET Framework | =4.6 | |
Any of | ||
Microsoft Windows 10 | ||
Microsoft Windows Server 2008 | =sp2 | |
All of | ||
Microsoft .NET Framework | =4.6.1 | |
Microsoft Windows 10 | =1511 | |
All of | ||
Any of | ||
Microsoft .NET Framework | =4.6.2 | |
Microsoft .NET Framework | =4.7 | |
Any of | ||
Microsoft Windows 10 | =1607 | |
Microsoft Windows Server 2016 | ||
All of | ||
Any of | ||
Microsoft .NET Framework | =4.6 | |
Microsoft .NET Framework | =4.6.1 | |
Microsoft .NET Framework | =4.6.2 | |
Microsoft .NET Framework | =4.7 | |
Any of | ||
Microsoft Windows 7 | =sp1 | |
Microsoft Windows 8.1 | ||
Microsoft Windows RT 8.1 | ||
Microsoft Windows Server 2008 | =r2-sp1 | |
Microsoft Windows Server 2012 | ||
Microsoft Windows Server 2012 | =r2 | |
All of | ||
Microsoft .NET Framework | =4.7 | |
Microsoft Windows 10 | =1703 | |
All of | ||
Microsoft .NET Framework | =4.7.1 | |
Microsoft Windows 10 | =1709 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2018-0764 is high with a CVSS score of 7.5.
The affected software for CVE-2018-0764 includes Microsoft .NET Framework versions 1.1 to 5.7, .NET Core 1.0, 1.1, and 2.0, and PowerShell Core 6.0.
CVE-2018-0764 allows a denial of service vulnerability due to the way XML documents are processed.
More information about CVE-2018-0764 can be found at the following references: [SecurityFocus](http://www.securityfocus.com/bid/102387), [SecurityTracker](http://www.securitytracker.com/id/1040152), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2018:0379).
To fix CVE-2018-0764, update to the latest versions of the affected software. Refer to the vendor's advisories and apply the recommended patches.