Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2013-3129 | First vendor Publication | 2013-07-09 |
Vendor | Cve | Last vendor Modification | 2025-01-16 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability." |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3129 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:17323 | |||
Oval ID: | oval:org.mitre.oval:def:17323 | ||
Title: | TrueType font parsing vulnerability in Microsoft Silverlight - CVE-2013-3129, MS13-052 (Mac OS) | ||
Description: | Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability." | ||
Family: | macos | Class: | vulnerability |
Reference(s): | CVE-2013-3129 | Version: | 3 |
Platform(s): | Apple Mac OS X Apple Mac OS X Server | Product(s): | Microsoft Silverlight 5 for Mac |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:17341 | |||
Oval ID: | oval:org.mitre.oval:def:17341 | ||
Title: | TrueType Font Parsing Vulnerability - CVE-2013-3129 (MS13-052, MS13-053, MS13-054) | ||
Description: | Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2013-3129 | Version: | 23 |
Platform(s): | Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.0 Microsoft .NET Framework 4.5 Microsoft Silverlight 5 Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 Microsoft Lync 2010 Microsoft Lync Basic 2013 Microsoft Lync 2010 Attendee Microsoft Visual Studio .NET 2003 |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 5 | |
Application | 5 | |
Application | 2 | |
Application | 4 | |
Application |
| 6 |
Application | 1 | |
Os | 2 | |
Os | 2 | |
Os | 1 | |
Os | 1 | |
Os | 3 | |
Os | 1 | |
Os | 1 | |
Os | 2 |
ExploitDB Exploits
id | Description |
---|---|
2014-05-06 | Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei) |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2013-07-11 | IAVM : 2013-A-0135 - Microsoft GDI+ Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0039199 |
2013-07-11 | IAVM : 2013-B-0071 - Multiple Vulnerabilities in Microsoft .NET Framework and Silverlight Severity : Category II - VMSKEY : V0039211 |
Snort® IPS/IDS
Date | Description |
---|---|
2016-03-14 | Microsoft Windows FlattenPath paged memory consumption privilege escalation a... RuleID : 36384 - Revision : 3 - Type : OS-WINDOWS |
2016-03-14 | Microsoft Windows FlattenPath paged memory consumption privilege escalation a... RuleID : 36383 - Revision : 3 - Type : OS-WINDOWS |
2014-06-07 | Microsoft Windows NtUserMessageCall implementation exploitation attempt RuleID : 30939 - Revision : 5 - Type : FILE-EXECUTABLE |
2014-01-10 | Microsoft Windows FlattenPath paged memory consumption privilege escalation a... RuleID : 27231 - Revision : 4 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Windows .NET CLR mutlidimensional array handling remote code execut... RuleID : 27139 - Revision : 3 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Windows .NET CLR mutlidimensional array handling remote code execut... RuleID : 27136 - Revision : 4 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Windows FlattenPath paged memory consumption privilege escalation a... RuleID : 26922 - Revision : 6 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-12-11 | Name : The remote Windows host has a remote code execution vulnerability. File : smb_nt_ms13-096.nasl - Type : ACT_GATHER_INFO |
2013-07-10 | Name : A multimedia application framework installed on the remote Mac OS X host is a... File : macosx_ms13-052.nasl - Type : ACT_GATHER_INFO |
2013-07-10 | Name : The .NET Framework install on the remote Windows host could allow arbitrary c... File : smb_nt_ms13-052.nasl - Type : ACT_GATHER_INFO |
2013-07-10 | Name : The Windows kernel on the remote host is affected by multiple vulnerabilities. File : smb_nt_ms13-053.nasl - Type : ACT_GATHER_INFO |
2013-07-10 | Name : The remote Windows host has a remote code execution vulnerability. File : smb_nt_ms13-054.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2025-01-17 00:21:32 |
|
2024-11-28 12:35:36 |
|
2024-08-02 12:24:18 |
|
2024-08-02 01:07:16 |
|
2024-02-02 01:23:37 |
|
2024-02-01 12:07:03 |
|
2023-12-07 21:27:59 |
|
2023-09-05 12:22:19 |
|
2023-09-05 01:06:57 |
|
2023-09-02 12:22:21 |
|
2023-09-02 01:07:02 |
|
2023-08-22 12:20:05 |
|
2022-10-11 01:06:43 |
|
2021-05-04 12:26:30 |
|
2021-04-22 01:32:04 |
|
2020-11-24 12:10:26 |
|
2020-09-28 17:22:46 |
|
2020-05-23 00:37:33 |
|
2019-05-09 12:05:26 |
|
2019-02-26 17:19:39 |
|
2018-10-13 05:18:40 |
|
2017-09-19 09:26:11 |
|
2016-10-19 21:22:34 |
|
2016-04-26 23:23:26 |
|
2014-02-17 11:20:26 |
|
2013-11-11 12:40:29 |
|
2013-11-04 21:27:41 |
|
2013-07-20 17:19:32 |
|
2013-07-10 17:28:18 |
|
2013-07-10 13:20:16 |
|