IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.8Alta KEV

CVE-2013-3906Microsoft Graphics Component Memory Corruption Vulnerability

microsoft excel viewer; microsoft lync; microsoft office; microsoft office compatibility pack Publicada: (hace 13 años)

Explotación conocida — Microsoft Graphics Component Memory Corruption Vulnerability

CISA confirmó el 15.02.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.08.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-3906

Descripción

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Debilidad (CWE): CWE-94

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
microsoft excel viewer —
microsoft lync 2010
microsoft office 2003
microsoft office compatibility pack —
microsoft powerpoint viewer 2010
microsoft windows server 2008 —
microsoft windows vista —
microsoft word viewer —

Referencias y parches

Coincidencias CPE (NVD) (13)
  • cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*
  • cpe:2.3:a:microsoft:lync:2013:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

CVE recientes del mismo producto — Windows Server

7.8Alta
CVE-2026-119382

Windows TPM Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.