MS KB2526954: Microsoft Silverlight 4.0 < 4.0.60310 Multiple Vulnerabilities

The remote Windows host is running a version of Microsoft Silverlight that is affected by multiple vulnerabilities : - A memory leak exists relating to a popup control and a custom 'DependencyProperty' property. CVE-2011-1844 - Multiple memory leaks exist in the 'DataGrid' control implementation...

CVE-2011-1844

Memory leak in Microsoft Silverlight 4 before 4.0.60310.0 allows remote attackers to cause a denial of service memory consumption via an application involving a popup control and a custom DependencyProperty property, related to lack of garbage collection...

CVE-2011-1845

Multiple memory leaks in the DataGrid control implementation in Microsoft Silverlight 4 before 4.0.60310.0 allow remote attackers to cause a denial of service memory consumption via an application involving 1 subscriptions to an INotifyDataErrorInfo.ErrorsChanged event or 2 a TextBlock or TextBox...

Design/Logic Flaw

Multiple memory leaks in the DataGrid control implementation in Microsoft Silverlight 4 before 4.0.60310.0 allow remote attackers to cause a denial of service memory consumption via an application involving 1 subscriptions to an INotifyDataErrorInfo.ErrorsChanged event or 2 a TextBlock or TextBox...

Memory corruption

Memory leak in Microsoft Silverlight 4 before 4.0.60310.0 allows remote attackers to cause a denial of service memory consumption via an application involving a popup control and a custom DependencyProperty property, related to lack of garbage collection...

CVE-2011-1844

Memory leak in Microsoft Silverlight 4 before 4.0.60310.0 allows remote attackers to cause a denial of service memory consumption via an application involving a popup control and a custom DependencyProperty property, related to lack of garbage collection...

CVE-2011-1845

Multiple memory leaks in the DataGrid control implementation in Microsoft Silverlight 4 before 4.0.60310.0 allow remote attackers to cause a denial of service memory consumption via an application involving 1 subscriptions to an INotifyDataErrorInfo.ErrorsChanged event or 2 a TextBlock or TextBox...

CVE-2011-1844

Microsoft Silverlight 4 prior to 4.0.60310.0 is affected by CVE-2011-1844 due to a memory leak in a popup control tied to a custom DependencyProperty, leading to possible denial of service from memory exhaustion. The issue is confirmed by multiple sources (NVD entry and Red Hat advisory) and is d...

CVE-2011-1845

Summary: CVE-2011-1845 affects Microsoft Silverlight 4, where multiple memory leaks in the DataGrid control implementation (and related INotifyDataErrorInfo and TextBlock/TextBox usage) can be exploited to cause a denial of service via memory consumption. The issue is triggered by specific UI sce...

CVE-2011-1844: Undefined Security Weakness

Memory leak in Microsoft Silverlight 4 before 4.0.60310.0 allows remote attackers to cause a denial of service memory consumption via an application involving a popup control and a custom DependencyProperty property, related to lack of garbage collection...

CVE-2011-1845: Undefined Security Weakness

Multiple memory leaks in the DataGrid control implementation in Microsoft Silverlight 4 before 4.0.60310.0 allow remote attackers to cause a denial of service memory consumption via an application involving 1 subscriptions to an INotifyDataErrorInfo.ErrorsChanged event or 2 a TextBlock or TextBox...

PT-2011-3405

Name of the Vulnerable Software and Affected Versions Microsoft Silverlight versions prior to 4.0.60310.0 Description The issue is related to a memory leak that can be triggered by an application involving a popup control and a custom DependencyProperty property. This is due to a lack of garbage...

PT-2011-3406

Name of the Vulnerable Software and Affected Versions Microsoft Silverlight versions prior to 4.0.60310.0 Description The issue is related to multiple memory leaks in the DataGrid control implementation. This can be exploited by remote attackers to cause a denial of service through memory...

Update for Microsoft Silverlight (KB2526954)

This update to Silverlight improves security, reliability, accessibility support, startup performance, enhances line-of-business support and includes several fixes to better support rich internet applications. This update is backward compatible with web applications built using previous versions ...

Watcher 1.4.1 - latest version download

"Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

CVE-2010-1898

The Common Language Runtime CLR in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote...

CVE-2010-0019

Microsoft Silverlight 3 before 3.0.50611.0 on Windows, and before 3.0.41130.0 on Mac OS X, does not properly handle pointers, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and framework outage via a crafted web site, aka "Microsoft...

Memory corruption

Microsoft Silverlight 3 before 3.0.50611.0 on Windows, and before 3.0.41130.0 on Mac OS X, does not properly handle pointers, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and framework outage via a crafted web site, aka "Microsoft...

Design/Logic Flaw

The Common Language Runtime CLR in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote...

CVE-2010-0019

Microsoft Silverlight 3 before 3.0.50611.0 on Windows, and before 3.0.41130.0 on Mac OS X, does not properly handle pointers, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and framework outage via a crafted web site, aka "Microsoft...