8.8High
KEV
CVE-2013-1347Microsoft Internet Explorer Remote Code Execution Vulnerability
Known exploited — Microsoft Internet Explorer Remote Code Execution Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.03.2022. Remediation deadline for US federal agencies: 24.03.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-1347
Description
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
Weakness (CWE):
CWE-416
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| microsoft | internet explorer | 8 |
References and patches
- 25294 exploitExploitThird Party AdvisoryVDB Entry
- TA13-134A third-party-advisoryThird Party AdvisoryUS Government Resource
- oval:org.mitre.oval:def:16727 vdb-entrysignatureBroken Link
- http://technet.microsoft.com/security/advisory/2847140 MitigationPatchVendor Advisory
- MS13-038 vendor-advisoryPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1347 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*