{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability","@odata.count":1,"value":[{"id":"00000000-0000-0000-0000-0000271d1d51","releaseDate":"2017-09-12T07:00:00Z","cveNumber":"CVE-2017-8759","cveTitle":".NET Framework Remote Code Execution Vulnerability","releaseNumber":"2017-Sep","vulnType":"Security Vulnerability","latestRevisionDate":"2017-10-03T07:00:00Z","description":"

A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input. An attacker who successfully exploited this vulnerability in software using the .NET framework could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

\n

To exploit the vulnerability, an attacker would first need to convince the user to open a malicious document or application.

\n

The security update addresses the vulnerability by correcting how .NET validates untrusted input.

\n","cweList":[],"cweDetailsListForSearch":[],"mitreText":"CVE-2017-8759","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2017-8759","publiclyDisclosed":"No","exploited":"Yes","latestSoftwareReleaseId":0,"latestSoftwareRelease":"Exploitation Detected","olderSoftwareReleaseId":0,"olderSoftwareRelease":"Exploitation Detected","denialOfService":"N/A","tag":".NET Framework","issuingCnaId":0,"severityId":0,"impactId":0,"langCode":"en-US","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":0,"cweDetailsList":[],"articles":[{"articleType":"FAQ","description":"

How do I determine which version of Microsoft .NET Framework is installed on my system?\nYou can install and run multiple versions of .NET Framework on a system, and you can install the versions in any order. For more information, see Microsoft Knowledge Base Article 318785.

\n

How do I locate the updates for the versions of .NET Framework installed on my system?\nThe download links in the Affected Products table are to the Parent KB number in the Microsoft Update Catalog. To locate the packages you need to download, in the Microsoft Update Catalog, click Download for the platform you have installed on your system. In the Download window, click to download each update that is applicable to your system.

\n

Customers who have updates automatically installed will be offered the Parent KB; however, the package KB numbers listed for each platform will be displayed in Add Remove Programs.

\n

The following table lists the Parent KB numbers for the Monthly Rollup Releases and the Security Only Releases, and the package KB numbers they contain. For more information about Microsoft's update servicing model for Microsoft .NET Framework, see this Microsoft .NET Blog Post.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Monthly Rollup ReleaseSecurity Only Release
PlatformParent KBChild KBsParent KBChild KBs
Windows Server 200840410864040978 - .NET Framework 2.040410934040964 - .NET Framework 2.0
4040977 - .NET Framework 4.5.24040960- .NET Framework 4.5.2
4040973 - .NET Framework 4.64040957 - .NET Framework 4.6
Windows 740410834040980 - .NET Framework 3.5.140410904040966 - .NET Framework 3.5.1
Windows Server 2008 R24040977 - .NET Framework 4.5.24040960- .NET Framework 4.5.2
4040973 - .NET Framework 4.6/4.6.1/4.6.2/4.74040957 - .NET Framework 4.6/4.6.1/4.6.2/4.7
Windows Server 201240410844040979 - .NET Framework 3.540410914040965 - .NET Framework 3.5
4040975 - .NET Framework 4.5.24040959 - .NET Framework 4.5.2
4040971 - .NET Framework 4.6/4.6.1/4.6.2/4.74040955 - .NET Framework 4.6/4.6.1/4.6.2/4.7
Windows 8.140410854040981 - .NET Framework 3.540410924040967 - .NET Framework 3.5
Windows Server 2012 R24040974 - .NET Framework 4.5.24040958 - .NET Framework 4.5.2
4040972 - .NET Framework 4.6/4.6.1/4.6.2/4.724040956 - .NET Framework 4.6/4.6.1/4.6.2/4.7
Windows 10 PlatformsParent KB.NET Framework Product
Windows 104038781.NET Framework 3.5None
.NET Framework 4.6
Windows 10 Version 15114038783.NET Framework 3.5None
.NET Framework 4.6.1
Windows 10 Version 16074038782.NET Framework 3.5None
.NET Framework 4.6.2/4.7
Windows Server 20164038782.NET Framework 3.5None
.NET Framework 4.6.2/4.7
Windows 10 Version 17034038788.NET Framework 3.5None
.NET Framework 4.7
\n","ordinal":10000}],"revisions":[{"version":1.1,"revisionDate":"2017-09-12T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"

Corrected Product versions and supersedence entries in the Affected Products table, corrected .NET versions in the table in the FAQ, and updated the acknowledgment. These are informational changes only. Customers who have already successfully installed the updates do not need to take any further action.

\n","notificationNeeded":false,"notificationSent":false},{"version":1.2,"revisionDate":"2017-10-03T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"

Corrected links to the Monthly Rollup KB articles for Microsoft .NET Framework 4.5.2 and Microsoft .NET Framework 4.6 installed on Windows Server 2008, and added a link to the 4041085 monthly rollup for Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 installed on Windows RT 8.1. This is an informational change only. Customers who have successfully installed the updates do not need to take any further action.

\n","notificationNeeded":false,"notificationSent":false},{"version":1,"revisionDate":"2017-09-12T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"

Information published.

\n","notificationNeeded":false,"notificationSent":false}]}]}