IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.8Yüksek KEV

CVE-2013-3906Microsoft Graphics Component Memory Corruption Vulnerability

microsoft excel viewer; microsoft lync; microsoft office; microsoft office compatibility pack Yayım: (12 yıl önce)

Aktif olarak istismar ediliyor — Microsoft Graphics Component Memory Corruption Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 15.02.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.08.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-3906

Açıklama

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Zayıflık türü (CWE): CWE-94

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
microsoft excel viewer —
microsoft lync 2010
microsoft office 2003
microsoft office compatibility pack —
microsoft powerpoint viewer 2010
microsoft windows server 2008 —
microsoft windows vista —
microsoft word viewer —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (13)
  • cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*
  • cpe:2.3:a:microsoft:lync:2013:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

Aynı üründe son açıklar — Windows Server

6.5Orta
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS