CVE-2016-0132
CriticalSummary
Microsoft .NET Framework versions 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandle signature validation for unspecified elements of XML documents, allowing remote attackers to spoof signatures via a modified document.
Risk Assessment
This vulnerability may lead to authorization fraud related to XML documents, threatening the integrity of data in applications using .NET Framework.
Recommendation
It is recommended to update to the latest version of .NET Framework to mitigate this vulnerability and implement additional XML signature verification mechanisms.
Other vulnerabilities in .NET Framework
See all- CVE-2017-8585High
Microsoft .NET Framework versions 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service.
- CVE-2017-0160High
Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7 allows an attacker with access to the local system to execute malicious code, known as '.NET Remote Code Execution Vulnerability.'
- CVE-2016-7270High
The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, allowing remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information.
- CVE-2016-0033High
Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, allowing remote attackers to cause a denial of service via crafted XSLT data.
- CVE-2014-4121High
Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 improperly parse internationalized resource identifiers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application.
- CVE-2014-4073High
A vulnerability in Microsoft .NET Framework allows remote attackers to gain privileges through unverified data during interaction with the ClickOnce installer. It affects versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.
- CVE-2014-1806High
The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, allowing remote attackers to execute arbitrary code via malformed objects.
- CVE-2026-65810High
Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
- CVE-2026-62897High
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
- CVE-2026-62872High
Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
Original NVD description (English source)
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."