CVE-2013-3906

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 84,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada microsoft excel viewer, microsoft lync +6 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 15 Februari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Rincian

Terbit di NVD

6 November 2013

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

84,9% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Graphics Component Memory Corruption Vulnerability

Masuk KEV

15 Februari 2022

Tenggat CISA

15 Agustus 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://technet.microsoft.com/security/advisory/2896666 patch · advisory vendor
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096 patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3906 pemerintah AS
• http://www.exploit-db.com/exploits/30011 exploit · advisory pihak ketiga · vdb entry
• http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2 broken link · exploit
• http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-wor... broken link · exploit