Lucene search

[email protected]NVD:CVE-2013-3906

HistoryNov 06, 2013 - 3:55 p.m.

CVE-2013-3906

2013-11-0615:55:05

CWE-94

[email protected]

web.nvd.nist.gov

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.967

Percentile

99.7%

JSON

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Affected configurations

Nvd

Node

microsoftexcel_viewerMatch-

microsoftlyncMatch2010attendee

microsoftlyncMatch2013

microsoftofficeMatch2003sp3

microsoftofficeMatch2007sp3

microsoftofficeMatch2010sp1

microsoftofficeMatch2010sp2

microsoftoffice_compatibility_packMatch-sp3

microsoftpowerpoint_viewerMatch2010sp1

microsoftpowerpoint_viewerMatch2010sp2

microsoftword_viewerMatch-

microsoftwindows_server_2008Match-sp2

microsoftwindows_vistaMatch-sp2

VendorProductVersionCPE
microsoftexcel_viewer-cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*
microsoftlync2010cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*
microsoftlync2013cpe:2.3:a:microsoft:lync:2013:*:*:*:*:*:*:*
microsoftoffice2003cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
microsoftoffice2007cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
microsoftoffice2010cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*
microsoftoffice2010cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
microsoftoffice_compatibility_pack-cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
microsoftpowerpoint_viewer2010cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp1:*:*:*:*:*:*
microsoftpowerpoint_viewer2010cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp2:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	excel_viewer	-	cpe:2.3:a:microsoft:excel_viewer:-:::::::*
microsoft	lync	2010	cpe:2.3:a:microsoft:lync:2010::::attendee:::
microsoft	lync	2013	cpe:2.3:a:microsoft:lync:2013:::::::*
microsoft	office	2003	cpe:2.3:a:microsoft:office:2003:sp3::::::
microsoft	office	2007	cpe:2.3:a:microsoft:office:2007:sp3::::::
microsoft	office	2010	cpe:2.3:a:microsoft:office:2010:sp1::::::
microsoft	office	2010	cpe:2.3:a:microsoft:office:2010:sp2::::::
microsoft	office_compatibility_pack	-	cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3::::::
microsoft	powerpoint_viewer	2010	cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp1::::::
microsoft	powerpoint_viewer	2010	cpe:2.3:a:microsoft:powerpoint_viewer:2010:sp2::::::