10 - TA13-253A

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	TA13-253A	First vendor Publication	2013-09-10
Vendor	US-CERT	Last vendor Modification	2013-09-10
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Overview

Select Microsoft software products contain multiple vulnerabilities. Microsoft has released updates to address these vulnerabilities.

Description

The Microsoft Security Bulletin Summary for September 2013 describes multiple vulnerabilities in Microsoft software. Microsoft has released updates to address these vulnerabilities.

Impact

These vulnerabilities could allow remote code execution, elevation of privilege, denial of service, or information disclosure.

Solution

Apply Updates

Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for September 2013, which describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. In addition, administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS). Home users are encouraged to enable automatic updates.

Original Source

Url : http://www.us-cert.gov/cas/techalerts/TA13-253A.html

CWE : Common Weakness Enumeration

%	Id	Name
74 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
9 %	CWE-20	Improper Input Validation
4 %	CWE-399	Resource Management Errors
4 %	CWE-200	Information Exposure
4 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
2 %	CWE-264	Permissions, Privileges, and Access Controls
2 %	CWE-94	Failure to Control Generation of Code ('Code Injection')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18065

Oval ID:	oval:org.mitre.oval:def:18065
Title:	Word Memory Corruption Vulnerability (CVE-2013-3855) - MS13-072
Description:	Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3855	Version:	7
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18114

Oval ID:	oval:org.mitre.oval:def:18114
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3208) - MS13-069
Description:	Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3208	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Internet Explorer 8 Microsoft Internet Explorer 9 Microsoft Internet Explorer 10
Definition Synopsis:
ie 8 on win xp/2003/vista/2008/win 7/2008 R2 Microsoft Internet Explorer 8 is installed AND either os win xp/server 2003 either os Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Check if the version of mshtml.dll is less than 8.0.6001.23520 OR vista/server 2008 either os Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.6001.19458 OR ldr range Check if the version of mshtml.dll is less than 8.0.6001.23520 AND Check for mshtml.dll version greater than or equal to 8.0.6001.23000 OR win 7/server 2008 r2 and version win 7/server 2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.7601.18228 OR ldr range Check if the version of mshtml.dll is less than 8.0.7601.22410 AND Check if the version of mshtml.dll is greater than or equal to 8.0.7601.22000 OR ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000 OR ie 10 on win 7/2008 r2/win 8/server 2012 Microsoft Internet Explorer 10 is installed AND ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18246

Oval ID:	oval:org.mitre.oval:def:18246
Title:	Word Memory Corruption Vulnerability (CVE-2013-3851) - MS13-072
Description:	Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3851	Version:	7
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions either files Check if the version of mso.dll is less than 11.0.8405 AND Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions either files Check if the version of mso.dll is less than 12.0.6683.5000 AND Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18281

Oval ID:	oval:org.mitre.oval:def:18281
Title:	Word Memory Corruption Vulnerability (CVE-2013-3848) - MS13-072
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3847, CVE-2013-3849, and CVE-2013-3858.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3848	Version:	8
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word 2010/versions Microsoft Word 2010 SP1 is installed AND Check if the version of winword.exe is less than 14.0.7106.5001 OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18333

Oval ID:	oval:org.mitre.oval:def:18333
Title:	Microsoft Office memory corruption vulnerability (CVE-2013-1315) - MS13-067
Description:	Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1315	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Server 2007 Microsoft SharePoint Server 2010 Microsoft Office Web Apps
Definition Synopsis:
sharepoint server 2007 sp3/version Microsoft Office SharePoint Server 2007 SP3 is installed AND Check if the version of xlsrv.dll is less than 12.0.6676.5000 OR sharepoint server 2010/version sharepoint server 2010 sp1/sp2 Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Microsoft SharePoint Server 2010 Service Pack 2 is installed AND either files versions Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 AND Check if the version of xlsrv.dll is less than 14.0.7104.5000 (sharepoint server) OR web apps/version office web apps sp1/sp2 Microsoft Office Web Apps 2010 Service Pack 1 is installed AND Microsoft Office Web Apps 2010 Service Pack 2 is installed AND either file versions Check if the version of msoserver.dll is less than 14.0.7106.5000 AND Check if the version of xlsrv.dll is less than 14.0.7104.5000 (web apps)

Definition Id: oval:org.mitre.oval:def:18442

Oval ID:	oval:org.mitre.oval:def:18442
Title:	Access File Format Memory Corruption Vulnerability (CVE-2013-3156) - MS13-074
Description:	Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Access file, aka "Access File Format Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3156	Version:	12
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012	Product(s):	Microsoft Office Access 2007 Microsoft Office Access 2010 Microsoft Office Access 2013
Definition Synopsis:
Access 2007 and vulnerable file version Microsoft Access 2007 SP3 is installed AND Check if the version of acecore.dll is less than 12.0.6679.5000 OR Office Access 2010 and vulnerable file version Office Access 2010 SP1 / SP2 Microsoft Access 2010 SP1 is installed AND Microsoft Access 2010 SP2 is installed AND Check if the version of acecore.dll is less than 14.0.7102.5000 OR Access 2013 and vulnerable file version Microsoft Access 2013 is installed AND Check if the version of acecore.dll is less than 15.0.4517.1003

Definition Id: oval:org.mitre.oval:def:18464

Oval ID:	oval:org.mitre.oval:def:18464
Title:	Word Memory Corruption Vulnerability (CVE-2013-3853) - MS13-072
Description:	Microsoft Office 2007 SP3 and Word 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3854.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3853	Version:	4
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2007
Definition Synopsis:
word 2007/versions either files Check if the version of msptls.dll is less than 12.0.6682.5000 AND Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed

Definition Id: oval:org.mitre.oval:def:18543

Oval ID:	oval:org.mitre.oval:def:18543
Title:	Microsoft Office Memory Corruption Vulnerability (CVE-2013-1315) MS13-073 (Mac OS X)
Description:	Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Family:	macos	Class:	vulnerability
Reference(s):	CVE-2013-1315	Version:	3
Platform(s):	Apple Mac OS X Apple Mac OS X Server	Product(s):	Microsoft Office 2011 for Mac
Definition Synopsis:
office mac 2011 Microsoft Office 2011 Service Pack 1 for Mac is installed AND Microsoft Office 2011 Service Pack 2 for Mac is installed AND Microsoft Office 2011 Service Pack 3 for Mac is installed AND Check if the version of Office 2011 for Mac is less than 14.3.7

Definition Id: oval:org.mitre.oval:def:18551

Oval ID:	oval:org.mitre.oval:def:18551
Title:	Win32k Elevation of Privilege Vulnerability (CVE-2013-1343) - MS13-076
Description:	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1342, CVE-2013-1344, CVE-2013-3864, and CVE-2013-3865.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1343	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):
Definition Synopsis:
XP x86 Check if the version of Win32k.sys is less than 5.1.2600.6436 AND Microsoft Windows XP (x86) SP3 is installed OR XP/2K3 and vulnerable file version XP/2K3 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Win32k.sys is less than 5.2.3790.5210 OR Vista/2K8 and vulnerable file version Vista/2K8 Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.0.6002.18912 OR Check for LDR Check if the version of Win32k.sys is less than 6.0.6002.23185 AND Check if the version of Win32k.sys is greater than or equal to 6.0.6002.23000 OR 7/2K8 R2 and vulnerable file version 7/2K8 R2 Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.1.7601.18233 OR Check for LDR Check if the version of Win32k.sys is less than 6.1.7601.22416 AND Check if the version of Win32k.sys is greater than or equal to 6.1.7601.22000 OR 8/2k12 and vulnerable file version 8/2k12 Microsoft Windows Server 2012 (64-bit) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows 8 (x86) is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.2.9200.16681 OR Check for LDR Check if the version of Win32k.sys is less than 6.2.9200.20789 AND Check if the version of Win32k.sys is greater than or equal to 6.2.9200.20000

Definition Id: oval:org.mitre.oval:def:18553

Oval ID:	oval:org.mitre.oval:def:18553
Title:	Win32k Elevation of Privilege Vulnerability (CVE-2013-3864) - MS13-076
Description:	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1342, CVE-2013-1343, CVE-2013-1344, and CVE-2013-3865.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3864	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):
Definition Synopsis:
XP x86 Check if the version of Win32k.sys is less than 5.1.2600.6436 AND Microsoft Windows XP (x86) SP3 is installed OR XP/2K3 and vulnerable file version XP/2K3 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Win32k.sys is less than 5.2.3790.5210 OR Vista/2K8 and vulnerable file version Vista/2K8 Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.0.6002.18912 OR Check for LDR Check if the version of Win32k.sys is less than 6.0.6002.23185 AND Check if the version of Win32k.sys is greater than or equal to 6.0.6002.23000 OR 7/2K8 R2 and vulnerable file version 7/2K8 R2 Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.1.7601.18233 OR Check for LDR Check if the version of Win32k.sys is less than 6.1.7601.22416 AND Check if the version of Win32k.sys is greater than or equal to 6.1.7601.22000 OR 8/2k12 and vulnerable file version 8/2k12 Microsoft Windows Server 2012 (64-bit) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows 8 (x86) is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.2.9200.16681 OR Check for LDR Check if the version of Win32k.sys is less than 6.2.9200.20789 AND Check if the version of Win32k.sys is greater than or equal to 6.2.9200.20000

Definition Id: oval:org.mitre.oval:def:18557

Oval ID:	oval:org.mitre.oval:def:18557
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3202) - MS13-069
Description:	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3202	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012	Product(s):	Microsoft Internet Explorer 10
Definition Synopsis:
Microsoft Internet Explorer 10 is installed ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18579

Oval ID:	oval:org.mitre.oval:def:18579
Title:	Windows Theme File Remote Code Execution Vulnerability - MS13-071
Description:	Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-0810	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008	Product(s):
Definition Synopsis:
win xp sp3 32-bit/version Microsoft Windows XP (x86) SP3 is installed AND Check if the version of Themeui.dll is less than 6.0.2900.6437 OR win xp sp2 64-bit/server 2003 sp2 (32/64/ia64)/version win xp sp2 64-bit/server 2003 sp2 (32/64/ia64) Microsoft Windows Server 2003 (ia64) SP2 is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows XP x64 Edition SP2 is installed AND Check if the version of Themeui.dll is less than 6.0.3790.5211 OR win vista sp2 x86/x64 and server 2008 sp2 (32/64/ia64)/version win vista sp2 x86/x64 and server 2008 sp2 (32/64/ia64) Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Themeui.dll - GDR/LDR Check if the version of Themeui.dll is less than 6.0.6002.18888 OR Themeui.dll - LDR Check if the version of Themeui.dll is greater than or equal to 6.0.6002.23000 AND Check if the version of Themeui.dll is less than 6.0.6002.23161

Definition Id: oval:org.mitre.oval:def:18624

Oval ID:	oval:org.mitre.oval:def:18624
Title:	Access Memory Corruption Vulnerability (CVE-2013-3155) - MS13-074
Description:	Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Access file, aka "Access Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3157.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3155	Version:	12
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012	Product(s):	Microsoft Office Access 2007 Microsoft Office Access 2010 Microsoft Office Access 2013
Definition Synopsis:
Access 2007 and vulnerable file version Microsoft Access 2007 SP3 is installed AND Check if the version of acecore.dll is less than 12.0.6679.5000 OR Office Access 2010 and vulnerable file version Office Access 2010 SP1 / SP2 Microsoft Access 2010 SP1 is installed AND Microsoft Access 2010 SP2 is installed AND Check if the version of acecore.dll is less than 14.0.7102.5000 OR Access 2013 and vulnerable file version Microsoft Access 2013 is installed AND Check if the version of acecore.dll is less than 15.0.4517.1003

Definition Id: oval:org.mitre.oval:def:18635

Oval ID:	oval:org.mitre.oval:def:18635
Title:	Word Memory Corruption Vulnerability (CVE-2013-3852) - MS13-072
Description:	Microsoft Word 2003 SP3, 2007 SP3, and 2010 SP1; Office Compatibility Pack SP3; and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3852	Version:	8
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word 2010/versions Microsoft Word 2010 SP1 is installed AND Check if the version of winword.exe is less than 14.0.7106.5001 OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18650

Oval ID:	oval:org.mitre.oval:def:18650
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3209) - MS13-069
Description:	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3201, CVE-2013-3203, CVE-2013-3206, and CVE-2013-3207.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3209	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista	Product(s):	Microsoft Internet Explorer 9 Microsoft Internet Explorer 10
Definition Synopsis:
ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000 OR ie 10 on win 7/2008 r2/win 8/server 2012 Microsoft Internet Explorer 10 is installed AND ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18651

Oval ID:	oval:org.mitre.oval:def:18651
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3201) - MS13-069
Description:	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3203, CVE-2013-3206, CVE-2013-3207, and CVE-2013-3209.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3201	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista	Product(s):	Microsoft Internet Explorer 9 Microsoft Internet Explorer 10
Definition Synopsis:
ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000 OR ie 10 on win 7/2008 r2/win 8/server 2012 Microsoft Internet Explorer 10 is installed AND ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18660

Oval ID:	oval:org.mitre.oval:def:18660
Title:	Win32k Elevation of Privilege Vulnerability (CVE-2013-1341) - MS13-076
Description:	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 8 allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1341	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8	Product(s):
Definition Synopsis:
XP x86 Check if the version of Win32k.sys is less than 5.1.2600.6436 AND Microsoft Windows XP (x86) SP3 is installed OR XP/2K3 and vulnerable file version XP/2K3 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Win32k.sys is less than 5.2.3790.5210 OR Vista/2K8 and vulnerable file version Vista/2K8 Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.0.6002.18912 OR Check for LDR Check if the version of Win32k.sys is less than 6.0.6002.23185 AND Check if the version of Win32k.sys is greater than or equal to 6.0.6002.23000 OR 7/2K8 R2 and vulnerable file version 7/2K8 R2 Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.1.7601.18233 OR Check for LDR Check if the version of Win32k.sys is less than 6.1.7601.22416 AND Check if the version of Win32k.sys is greater than or equal to 6.1.7601.22000 OR 8/2k12 and vulnerable file version 8/2k12 Microsoft Windows 8 (x64) is installed AND Microsoft Windows 8 (x86) is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.2.9200.16681 OR Check for LDR Check if the version of Win32k.sys is less than 6.2.9200.20789 AND Check if the version of Win32k.sys is greater than or equal to 6.2.9200.20000

Definition Id: oval:org.mitre.oval:def:18664

Oval ID:	oval:org.mitre.oval:def:18664
Title:	Access Memory Corruption Vulnerability (CVE-2013-3157) - MS13-074
Description:	Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Access file, aka "Access Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3155.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3157	Version:	12
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012	Product(s):	Microsoft Office Access 2007 Microsoft Office Access 2010 Microsoft Office Access 2013
Definition Synopsis:
Access 2007 and vulnerable file version Microsoft Access 2007 SP3 is installed AND Check if the version of acecore.dll is less than 12.0.6679.5000 OR Office Access 2010 and vulnerable file version Office Access 2010 SP1 / SP2 Microsoft Access 2010 SP1 is installed AND Microsoft Access 2010 SP2 is installed AND Check if the version of acecore.dll is less than 14.0.7102.5000 OR Access 2013 and vulnerable file version Microsoft Access 2013 is installed AND Check if the version of acecore.dll is less than 15.0.4517.1003

Definition Id: oval:org.mitre.oval:def:18686

Oval ID:	oval:org.mitre.oval:def:18686
Title:	XML External Entities Resolution Vulnerability (CVE-2013-3159) - MS13-073
Description:	Microsoft Excel 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Excel Viewer; and Microsoft Office Compatibility Pack SP3 allow remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "XML External Entities Resolution Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3159	Version:	6
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Excel 2003 Microsoft Excel 2007 Microsoft Excel 2010 Microsoft Excel Viewer 2007 Microsoft Office Compatibility Pack
Definition Synopsis:
excel 2003/versions Check if the version of excel.exe is less than 11.0.8404 AND Microsoft Excel 2003 SP3 is installed OR excel 2007/versions Check if the version of excel.exe is less than 12.0.6679.5000 AND Microsoft Excel 2007 SP3 is installed OR excel viewer/versions Microsoft Excel Viewer 2007 SP3 is installed AND Check if the version of xlview.exe is less than 12.0.6679.5000 OR compatibility pack/versions Check if the version of excelcnv.exe is less than 12.0.6679.5000 AND Microsoft Office Compatibility Pack SP3 is installed OR excel 2010/versions 2010 sp1/sp2 Microsoft Excel 2010 SP2 is installed AND Microsoft Excel 2010 SP1 is installed AND Check if the version of excel.exe is less than 14.0.7104.5000

Definition Id: oval:org.mitre.oval:def:18696

Oval ID:	oval:org.mitre.oval:def:18696
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3205) - MS13-069
Description:	Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3205	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8
Definition Synopsis:
ie6 Microsoft Internet Explorer 6 is installed AND either os ie6 on win xp Microsoft Windows XP (32-bit) is installed AND Check if the version of mshtml.dll is less than 6.0.2900.6434 OR ie 6 on win xp 64 bit, server 2003 (32+64+ia64) either of the os Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed AND Check if the version of mshtml.dll is less than 6.0.3790.5208 OR ie7 Microsoft Internet Explorer 7 is installed AND either os win xp/server 2003 either os Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed AND Check if the version of mshtml.dll is less than 7.0.6000.21352 OR vista/server 2008 either os Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (ia-64) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 7.0.6002.18910 OR ldr range Check if the version of mshtml.dll is less than 7.0.6002.23183 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR ie 8 on win xp/2003/vista/2008/win 7/2008 R2 Microsoft Internet Explorer 8 is installed AND either os win xp/server 2003 either os Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Check if the version of mshtml.dll is less than 8.0.6001.23520 OR vista/server 2008 either os Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.6001.19458 OR ldr range Check if the version of mshtml.dll is less than 8.0.6001.23520 AND Check for mshtml.dll version greater than or equal to 8.0.6001.23000 OR win 7/server 2008 r2 and version win 7/server 2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.7601.18228 OR ldr range Check if the version of mshtml.dll is less than 8.0.7601.22410 AND Check if the version of mshtml.dll is greater than or equal to 8.0.7601.22000

Definition Id: oval:org.mitre.oval:def:18709

Oval ID:	oval:org.mitre.oval:def:18709
Title:	Word Memory Corruption Vulnerability (CVE-2013-3858) - MS13-072
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3847, CVE-2013-3848, and CVE-2013-3849.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3858	Version:	8
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word 2010/versions Microsoft Word 2010 SP1 is installed AND Check if the version of winword.exe is less than 14.0.7106.5001 OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18714

Oval ID:	oval:org.mitre.oval:def:18714
Title:	Win32k Elevation of Privilege Vulnerability (CVE-2013-1342) - MS13-076
Description:	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1343, CVE-2013-1344, CVE-2013-3864, and CVE-2013-3865.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1342	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):
Definition Synopsis:
XP x86 Check if the version of Win32k.sys is less than 5.1.2600.6436 AND Microsoft Windows XP (x86) SP3 is installed OR XP/2K3 and vulnerable file version XP/2K3 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Win32k.sys is less than 5.2.3790.5210 OR Vista/2K8 and vulnerable file version Vista/2K8 Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.0.6002.18912 OR Check for LDR Check if the version of Win32k.sys is less than 6.0.6002.23185 AND Check if the version of Win32k.sys is greater than or equal to 6.0.6002.23000 OR 7/2K8 R2 and vulnerable file version 7/2K8 R2 Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.1.7601.18233 OR Check for LDR Check if the version of Win32k.sys is less than 6.1.7601.22416 AND Check if the version of Win32k.sys is greater than or equal to 6.1.7601.22000 OR 8/2k12 and vulnerable file version 8/2k12 Microsoft Windows Server 2012 (64-bit) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows 8 (x86) is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.2.9200.16681 OR Check for LDR Check if the version of Win32k.sys is less than 6.2.9200.20789 AND Check if the version of Win32k.sys is greater than or equal to 6.2.9200.20000

Definition Id: oval:org.mitre.oval:def:18719

Oval ID:	oval:org.mitre.oval:def:18719
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3845) - MS13-069
Description:	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3845	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Internet Explorer 8 Microsoft Internet Explorer 9
Definition Synopsis:
ie 8 on win xp/2003/vista/2008/win 7/2008 R2 Microsoft Internet Explorer 8 is installed AND either os win xp/server 2003 either os Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Check if the version of mshtml.dll is less than 8.0.6001.23520 OR vista/server 2008 either os Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.6001.19458 OR ldr range Check if the version of mshtml.dll is less than 8.0.6001.23520 AND Check for mshtml.dll version greater than or equal to 8.0.6001.23000 OR win 7/server 2008 r2 and version win 7/server 2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.7601.18228 OR ldr range Check if the version of mshtml.dll is less than 8.0.7601.22410 AND Check if the version of mshtml.dll is greater than or equal to 8.0.7601.22000 OR ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000

Definition Id: oval:org.mitre.oval:def:18741

Oval ID:	oval:org.mitre.oval:def:18741
Title:	Word Memory Corruption Vulnerability (CVE-2013-3857) - MS13-072
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1 and SP2, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3857	Version:	8
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word 2010/versions 2010 sp1/sp2 Microsoft Word 2010 SP2 is installed AND Microsoft Word 2010 SP1 is installed AND Check if the version of winword.exe is less than 14.0.7106.5001 OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18749

Oval ID:	oval:org.mitre.oval:def:18749
Title:	Word Memory Corruption Vulnerability (CVE-2013-3847) - MS13-072
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3848, CVE-2013-3849, and CVE-2013-3858.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3847	Version:	8
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word 2010/versions Microsoft Word 2010 SP1 is installed AND Check if the version of winword.exe is less than 14.0.7106.5001 OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18750

Oval ID:	oval:org.mitre.oval:def:18750
Title:	Cross-site scripting vulnerability in Microsoft SharePoint (CVE-2013-3179) - MS13-067
Description:	Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3179	Version:	9
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Foundation 2010 Microsoft SharePoint Foundation 2013 Microsoft SharePoint Server 2007 Microsoft SharePoint Server 2010 Microsoft SharePoint Server 2013 Microsoft SharePoint Services 3.0
Definition Synopsis:
sharepoint services 3.0 sp3/version Microsoft SharePoint Services 3.0 SP3 is installed AND Check if the version of Onetutil.dll is less than 12.0.6676.5000 OR foundation 2010/version Check if the version of onetutil.dll is less than 14.0.7105.5000 AND foundation 2010 sp1/sp2 Microsoft SharePoint Foundation 2010 Service Pack 1 is installed AND Microsoft SharePoint Foundation 2010 Service Pack 2 is installed OR sharepoint server 2010/version sharepoint server 2010 sp1/sp2 Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Microsoft SharePoint Server 2010 Service Pack 2 is installed AND either files versions Check if the version of microsoft.office.server.native.dll is less than 14.0.7005.1000 AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 AND Check if the version of xlsrv.dll is less than 14.0.7104.5000 (sharepoint server) OR foundation 2013/version Check if the version of Microsoft.office.server.native.dll is less than 15.0.4535.1000 AND Microsoft SharePoint Server 2013 is installed OR sharepoint foundation 2013/version Microsoft SharePoint Foundation 2013 is installed AND Check if the version of Onfda.dll is less than 15.0.4535.1000

Definition Id: oval:org.mitre.oval:def:18753

Oval ID:	oval:org.mitre.oval:def:18753
Title:	Word Memory Corruption Vulnerability (CVE-2013-3850) - MS13-072
Description:	Microsoft Word 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3850	Version:	8
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word 2010/versions 2010 sp1/sp2 Microsoft Word 2010 SP2 is installed AND Microsoft Word 2010 SP1 is installed AND Check if the version of winword.exe is less than 14.0.7106.5001 OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18759

Oval ID:	oval:org.mitre.oval:def:18759
Title:	OLE Property Vulnerability - MS13-070
Description:	Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to execute arbitrary code via a crafted OLE object in a file, aka "OLE Property Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3863	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003	Product(s):
Definition Synopsis:
Vulnerable Microsoft Windows XP (x86) SP3 Microsoft Windows XP (x86) SP3 is installed AND Check if the version of Ole32.dll is less than 5.1.2600.6435 OR Vulnerable Microsoft Windows XP x64 SP2, Server 2003 x86/x64/ia64 SP2 Vulnerable Microsoft Windows XP x64 SP2, Server 2003 x86/x64/ia64 SP2 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Ole32.dll is less than 5.2.3790.5209

Definition Id: oval:org.mitre.oval:def:18774

Oval ID:	oval:org.mitre.oval:def:18774
Title:	Word Memory Corruption Vulnerability (CVE-2013-3849) - MS13-072
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3847, CVE-2013-3848, and CVE-2013-3858.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3849	Version:	8
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word 2010 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word 2010/versions Microsoft Word 2010 SP1 is installed AND Check if the version of winword.exe is less than 14.0.7106.5001 OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18792

Oval ID:	oval:org.mitre.oval:def:18792
Title:	Win32k Elevation of Privilege Vulnerability (CVE-2013-1344) - MS13-076
Description:	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1342, CVE-2013-1343, CVE-2013-3864, and CVE-2013-3865.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1344	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):
Definition Synopsis:
XP x86 Check if the version of Win32k.sys is less than 5.1.2600.6436 AND Microsoft Windows XP (x86) SP3 is installed OR XP/2K3 and vulnerable file version XP/2K3 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Win32k.sys is less than 5.2.3790.5210 OR Vista/2K8 and vulnerable file version Vista/2K8 Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.0.6002.18912 OR Check for LDR Check if the version of Win32k.sys is less than 6.0.6002.23185 AND Check if the version of Win32k.sys is greater than or equal to 6.0.6002.23000 OR 7/2K8 R2 and vulnerable file version 7/2K8 R2 Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.1.7601.18233 OR Check for LDR Check if the version of Win32k.sys is less than 6.1.7601.22416 AND Check if the version of Win32k.sys is greater than or equal to 6.1.7601.22000 OR 8/2k12 and vulnerable file version 8/2k12 Microsoft Windows Server 2012 (64-bit) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows 8 (x86) is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.2.9200.16681 OR Check for LDR Check if the version of Win32k.sys is less than 6.2.9200.20789 AND Check if the version of Win32k.sys is greater than or equal to 6.2.9200.20000

Definition Id: oval:org.mitre.oval:def:18797

Oval ID:	oval:org.mitre.oval:def:18797
Title:	Word Memory Corruption Vulnerability (CVE-2013-3856) - MS13-072
Description:	Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3856	Version:	4
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word Viewer
Definition Synopsis:
word 2003/versions Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406

Definition Id: oval:org.mitre.oval:def:18800

Oval ID:	oval:org.mitre.oval:def:18800
Title:	Denial of service vulnerability in Microsoft SharePoint (CVE-2013-3848) - MS13-067
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3847, CVE-2013-3849, and CVE-2013-3858.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3848	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Server 2010 Microsoft Office Web Apps
Definition Synopsis:
sharepoint server 2010/version Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 OR web apps/version Microsoft Office Web Apps 2010 Service Pack 1 is installed AND Check if the version of msoserver.dll is less than 14.0.7106.5000

Definition Id: oval:org.mitre.oval:def:18801

Oval ID:	oval:org.mitre.oval:def:18801
Title:	Memory corruption vulnerability in Microsoft SharePoint (CVE-2013-3858) - MS13-067
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3847, CVE-2013-3848, and CVE-2013-3849.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3858	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Office Web Apps Microsoft SharePoint Server 2010
Definition Synopsis:
sharepoint server 2010/version Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 OR web apps/version Microsoft Office Web Apps 2010 Service Pack 1 is installed AND Check if the version of msoserver.dll is less than 14.0.7106.5000

Definition Id: oval:org.mitre.oval:def:18813

Oval ID:	oval:org.mitre.oval:def:18813
Title:	Win32k Elevation of Privilege Vulnerability (CVE-2013-3865) - MS13-076
Description:	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1342, CVE-2013-1343, CVE-2013-1344, and CVE-2013-3864.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3865	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):
Definition Synopsis:
XP x86 Check if the version of Win32k.sys is less than 5.1.2600.6436 AND Microsoft Windows XP (x86) SP3 is installed OR XP/2K3 and vulnerable file version XP/2K3 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Win32k.sys is less than 5.2.3790.5210 OR Vista/2K8 and vulnerable file version Vista/2K8 Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.0.6002.18912 OR Check for LDR Check if the version of Win32k.sys is less than 6.0.6002.23185 AND Check if the version of Win32k.sys is greater than or equal to 6.0.6002.23000 OR 7/2K8 R2 and vulnerable file version 7/2K8 R2 Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.1.7601.18233 OR Check for LDR Check if the version of Win32k.sys is less than 6.1.7601.22416 AND Check if the version of Win32k.sys is greater than or equal to 6.1.7601.22000 OR 8/2k12 and vulnerable file version 8/2k12 Microsoft Windows Server 2012 (64-bit) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows 8 (x86) is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.2.9200.16681 OR Check for LDR Check if the version of Win32k.sys is less than 6.2.9200.20789 AND Check if the version of Win32k.sys is greater than or equal to 6.2.9200.20000

Definition Id: oval:org.mitre.oval:def:18819

Oval ID:	oval:org.mitre.oval:def:18819
Title:	Word Memory Corruption Vulnerability (CVE-2013-3160) - MS13-072
Description:	Microsoft Office 2003 SP3 and 2007 SP3, Word 2003 SP3 and 2007 SP3, and Word Viewer allow remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "XML External Entities Resolution Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3160	Version:	7
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2003 Microsoft Word 2007 Microsoft Word Viewer Microsoft Office Compatibility Pack
Definition Synopsis:
word 2003/versions either files Check if the version of mso.dll is less than 11.0.8405 AND Check if the version of winword.exe is less than 11.0.8406 AND Microsoft Word 2003 SP3 is installed OR word 2007/versions either files Check if the version of mso.dll is less than 12.0.6683.5000 AND Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed OR word viewer/versions Microsoft Word Viewer 2003 SP3 is installed AND Check if the version of wordview is less than 11.0.8406 OR office compatibility pack/version Check if the version of wordcnv.dll is less than 12.0.6683.5001 AND Microsoft Office Compatibility Pack SP3 is installed

Definition Id: oval:org.mitre.oval:def:18855

Oval ID:	oval:org.mitre.oval:def:18855
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3206) - MS13-069
Description:	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3201, CVE-2013-3203, CVE-2013-3207, and CVE-2013-3209.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3206	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista	Product(s):	Microsoft Internet Explorer 9 Microsoft Internet Explorer 10
Definition Synopsis:
ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000 OR ie 10 on win 7/2008 r2/win 8/server 2012 Microsoft Internet Explorer 10 is installed AND ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18857

Oval ID:	oval:org.mitre.oval:def:18857
Title:	Message Certificate Vulnerability (CVE-2013-3870) - MS13-068
Description:	Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3870	Version:	4
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Microsoft Outlook 2007 Microsoft Outlook 2010
Definition Synopsis:
Outlook 2007 and vulnerable file version Microsoft Outlook 2007 SP3 is installed AND Check if the version of outlook.exe is less than 12.0.6680.5000 OR Office 2010 and vulnerable file version Office 2010 base / SP1 / SP2 Microsoft Outlook 2010 SP1 is installed AND Microsoft Outlook 2010 SP2 is installed AND Check if the version of outlook.exe is less than 14.0.7105.5000

Definition Id: oval:org.mitre.oval:def:18916

Oval ID:	oval:org.mitre.oval:def:18916
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3203) - MS13-069
Description:	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3201, CVE-2013-3206, CVE-2013-3207, and CVE-2013-3209.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3203	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista	Product(s):	Microsoft Internet Explorer 9 Microsoft Internet Explorer 10
Definition Synopsis:
ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000 OR ie 10 on win 7/2008 r2/win 8/server 2012 Microsoft Internet Explorer 10 is installed AND ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18942

Oval ID:	oval:org.mitre.oval:def:18942
Title:	Word memory corruption vulnerability in Microsoft SharePoint (CVE-2013-3857) - MS13-067
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1 and SP2, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3857	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Server 2010 Microsoft Office Web Apps
Definition Synopsis:
sharepoint server 2010/version sharepoint server 2010 sp1/sp2 Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Microsoft SharePoint Server 2010 Service Pack 2 is installed AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 OR web apps/version office web apps sp1/sp2 Microsoft Office Web Apps 2010 Service Pack 1 is installed AND Microsoft Office Web Apps 2010 Service Pack 2 is installed AND Check if the version of msoserver.dll is less than 14.0.7106.5000

Definition Id: oval:org.mitre.oval:def:18950

Oval ID:	oval:org.mitre.oval:def:18950
Title:	Microsoft Office Memory Corruption Vulnerability (CVE-2013-1315) - MS13-073
Description:	Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1315	Version:	6
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Excel 2003 Microsoft Excel 2007 Microsoft Excel 2010 Microsoft Excel 2013 Microsoft Excel Viewer 2007 Microsoft Office Compatibility Pack
Definition Synopsis:
excel 2003/versions Check if the version of excel.exe is less than 11.0.8404 AND Microsoft Excel 2003 SP3 is installed OR excel 2007/versions Check if the version of excel.exe is less than 12.0.6679.5000 AND Microsoft Excel 2007 SP3 is installed OR excel viewer/versions Microsoft Excel Viewer 2007 SP3 is installed AND Check if the version of xlview.exe is less than 12.0.6679.5000 OR compatibility pack/versions Check if the version of excelcnv.exe is less than 12.0.6679.5000 AND Microsoft Office Compatibility Pack SP3 is installed OR excel 2010/versions 2010 sp1/sp2 Microsoft Excel 2010 SP2 is installed AND Microsoft Excel 2010 SP1 is installed AND Check if the version of excel.exe is less than 14.0.7104.5000 OR excel 2013/versions Microsoft Excel 2013 is installed AND Check if the version of excel.exe is less than 15.0.4535.1003

Definition Id: oval:org.mitre.oval:def:18951

Oval ID:	oval:org.mitre.oval:def:18951
Title:	Win32k Elevation of Privilege Vulnerability (CVE-2013-3866) - MS13-076
Description:	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3866	Version:	3
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):
Definition Synopsis:
XP x86 Check if the version of Win32k.sys is less than 5.1.2600.6436 AND Microsoft Windows XP (x86) SP3 is installed OR XP/2K3 and vulnerable file version XP/2K3 Microsoft Windows XP x64 Edition SP2 is installed AND Microsoft Windows Server 2003 SP2 (x64) is installed AND Microsoft Windows Server 2003 SP2 (x86) is installed AND Microsoft Windows Server 2003 (ia64) SP2 is installed AND Check if the version of Win32k.sys is less than 5.2.3790.5210 OR Vista/2K8 and vulnerable file version Vista/2K8 Microsoft Windows Vista x64 Edition Service Pack 2 is installed AND Microsoft Windows Vista (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed AND Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed AND Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.0.6002.18912 OR Check for LDR Check if the version of Win32k.sys is less than 6.0.6002.23185 AND Check if the version of Win32k.sys is greater than or equal to 6.0.6002.23000 OR 7/2K8 R2 and vulnerable file version 7/2K8 R2 Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.1.7601.18233 OR Check for LDR Check if the version of Win32k.sys is less than 6.1.7601.22416 AND Check if the version of Win32k.sys is greater than or equal to 6.1.7601.22000 OR 8/2k12 and vulnerable file version 8/2k12 Microsoft Windows Server 2012 (64-bit) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows 8 (x86) is installed AND Check for vulnerable version Check if the version of Win32k.sys is less than 6.2.9200.16681 OR Check for LDR Check if the version of Win32k.sys is less than 6.2.9200.20789 AND Check if the version of Win32k.sys is greater than or equal to 6.2.9200.20000

Definition Id: oval:org.mitre.oval:def:18964

Oval ID:	oval:org.mitre.oval:def:18964
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3207) - MS13-069
Description:	Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3201, CVE-2013-3203, CVE-2013-3206, and CVE-2013-3209.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3207	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista	Product(s):	Microsoft Internet Explorer 9 Microsoft Internet Explorer 10
Definition Synopsis:
ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000 OR ie 10 on win 7/2008 r2/win 8/server 2012 Microsoft Internet Explorer 10 is installed AND ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18975

Oval ID:	oval:org.mitre.oval:def:18975
Title:	Internet Explorer Memory Corruption Vulnerability (CVE-2013-3204) - MS13-069
Description:	Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3204	Version:	5
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 Microsoft Internet Explorer 9 Microsoft Internet Explorer 10
Definition Synopsis:
ie7 Microsoft Internet Explorer 7 is installed AND either os win xp/server 2003 either os Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Microsoft Windows Server 2003 (ia64) Gold is installed AND Check if the version of mshtml.dll is less than 7.0.6000.21352 OR vista/server 2008 either os Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (ia-64) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 7.0.6002.18910 OR ldr range Check if the version of mshtml.dll is less than 7.0.6002.23183 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR ie 8 on win xp/2003/vista/2008/win 7/2008 R2 Microsoft Internet Explorer 8 is installed AND either os win xp/server 2003 either os Microsoft Windows XP (32-bit) is installed AND Microsoft Windows XP x64 is installed AND Microsoft Windows Server 2003 (32-bit) is installed AND Microsoft Windows Server 2003 (x64) is installed AND Check if the version of mshtml.dll is less than 8.0.6001.23520 OR vista/server 2008 either os Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.6001.19458 OR ldr range Check if the version of mshtml.dll is less than 8.0.6001.23520 AND Check for mshtml.dll version greater than or equal to 8.0.6001.23000 OR win 7/server 2008 r2 and version win 7/server 2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 8.0.7601.18228 OR ldr range Check if the version of mshtml.dll is less than 8.0.7601.22410 AND Check if the version of mshtml.dll is greater than or equal to 8.0.7601.22000 OR ie 9 on winvista/2008/win 7/2008 r2 Microsoft Internet Explorer 9 is installed AND win vista/2008/7/2008 r2 Microsoft Windows Vista (32-bit) is installed AND Microsoft Windows Vista x64 Edition is installed AND Microsoft Windows Server 2008 (32-bit) is installed AND Microsoft Windows Server 2008 (64-bit) is installed AND Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 9.0.8112.16506 OR ldr range Check if the version of mshtml.dll is less than 9.0.8112.20617 AND Check for mshtml.dll version greater than or equal to 9.0.8112.20000 OR ie 10 on win 7/2008 r2/win 8/server 2012 Microsoft Internet Explorer 10 is installed AND ie 10 on win 7/2008 r2/win 8/server 2012 win 7/2008 r2 and version win 7/2008 r2 Microsoft Windows 7 (32-bit) is installed AND Microsoft Windows 7 x64 Edition is installed AND Microsoft Windows Server 2008 R2 x64 Edition is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16686 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20794 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000 OR win 8/2012 and version win 8/2012 Microsoft Windows 8 (x86) is installed AND Microsoft Windows 8 (x64) is installed AND Microsoft Windows Server 2012 (64-bit) is installed AND gdr/ldr Check if the version of mshtml.dll is less than 10.0.9200.16688 OR ldr range Check if the version of mshtml.dll is less than 10.0.9200.20796 AND Check if the version of mshtml.dll is greater than or equal to 10.0.9200.20000

Definition Id: oval:org.mitre.oval:def:18984

Oval ID:	oval:org.mitre.oval:def:18984
Title:	Microsoft Office Memory Corruption Vulnerability (CVE-2013-3158) - MS13-073
Description:	Microsoft Excel 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3158	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Excel 2003 Microsoft Excel 2007
Definition Synopsis:
excel 2003/versions Check if the version of excel.exe is less than 11.0.8404 AND Microsoft Excel 2003 SP3 is installed OR excel 2007/versions Check if the version of excel.exe is less than 12.0.6679.5000 AND Microsoft Excel 2007 SP3 is installed

Definition Id: oval:org.mitre.oval:def:18988

Oval ID:	oval:org.mitre.oval:def:18988
Title:	Denial of service vulnerability in Microsoft SharePoint (CVE-2013-3847) - MS13-067
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3848, CVE-2013-3849, and CVE-2013-3858.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3847	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Server 2010 Microsoft Office Web Apps
Definition Synopsis:
sharepoint server 2010/version Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 OR web apps/version Microsoft Office Web Apps 2010 Service Pack 1 is installed AND Check if the version of msoserver.dll is less than 14.0.7106.5000

Definition Id: oval:org.mitre.oval:def:19009

Oval ID:	oval:org.mitre.oval:def:19009
Title:	Word Memory Corruption Vulnerability (CVE-2013-3854) - MS13-072
Description:	Microsoft Office 2007 SP3 and Word 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3853.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3854	Version:	4
Platform(s):	Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Word 2007
Definition Synopsis:
word 2007/versions either files Check if the version of msptls.dll is less than 12.0.6682.5000 AND Check if the version of winword.exe is less than 12.0.6683.5001 AND Microsoft Word 2007 SP3 is installed

Definition Id: oval:org.mitre.oval:def:19036

Oval ID:	oval:org.mitre.oval:def:19036
Title:	Denial of service vulnerability in Microsoft SharePoint (CVE-2013-0081) - MS13-067
Description:	Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service (W3WP process hang) via a crafted URL, aka "SharePoint Denial of Service Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-0081	Version:	9
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Foundation 2010 Microsoft SharePoint Foundation 2013 Microsoft SharePoint Server 2007 Microsoft SharePoint Server 2010 Microsoft SharePoint Server 2013 Microsoft SharePoint Services 2.0 Microsoft SharePoint Services 3.0
Definition Synopsis:
sharepoint services 2.0/version Microsoft Windows SharePoint Services 2.0 is installed AND Check if the version of onetutil.dll is less than 11.0.8346.0 OR sharepoint services 3.0 sp3/version Microsoft SharePoint Services 3.0 SP3 is installed AND Check if the version of Onetutil.dll is less than 12.0.6676.5000 OR foundation 2010/version Check if the version of onetutil.dll is less than 14.0.7105.5000 AND foundation 2010 sp1/sp2 Microsoft SharePoint Foundation 2010 Service Pack 1 is installed AND Microsoft SharePoint Foundation 2010 Service Pack 2 is installed OR sharepoint server 2010/version sharepoint server 2010 sp1/sp2 Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Microsoft SharePoint Server 2010 Service Pack 2 is installed AND either files versions Check if the version of microsoft.office.server.native.dll is less than 14.0.7005.1000 AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 AND Check if the version of xlsrv.dll is less than 14.0.7104.5000 (sharepoint server) OR foundation 2013/version Check if the version of Microsoft.office.server.native.dll is less than 15.0.4535.1000 AND Microsoft SharePoint Server 2013 is installed OR sharepoint foundation 2013/version Microsoft SharePoint Foundation 2013 is installed AND Check if the version of Onfda.dll is less than 15.0.4535.1000

Definition Id: oval:org.mitre.oval:def:19040

Oval ID:	oval:org.mitre.oval:def:19040
Title:	MAC disabled vulnerability in Microsoft SharePoint and Microsoft Exchange Server (CVE-2013-1330) - MS13-067, MS13-105
Description:	The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC Disabled Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-1330	Version:	9
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft Exchange Server 2007 Microsoft Exchange Server 2010 Microsoft Exchange Server 2013 Microsoft SharePoint Foundation 2010 Microsoft SharePoint Server 2007 Microsoft SharePoint Server 2010 Microsoft SharePoint Services 2.0 Microsoft SharePoint Services 3.0
Definition Synopsis:
sharepoint services 2.0/version Microsoft Windows SharePoint Services 2.0 is installed AND Check if the version of onetutil.dll is less than 11.0.8346.0 OR sharepoint services 3.0 sp3/version Microsoft SharePoint Services 3.0 SP3 is installed AND Check if the version of Onetutil.dll is less than 12.0.6676.5000 OR foundation 2010/version Check if the version of onetutil.dll is less than 14.0.7105.5000 AND foundation 2010 sp1/sp2 Microsoft SharePoint Foundation 2010 Service Pack 1 is installed AND Microsoft SharePoint Foundation 2010 Service Pack 2 is installed OR sharepoint server 2010/version sharepoint server 2010 sp1/sp2 Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Microsoft SharePoint Server 2010 Service Pack 2 is installed AND either files versions Check if the version of microsoft.office.server.native.dll is less than 14.0.7005.1000 AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 AND Check if the version of xlsrv.dll is less than 14.0.7104.5000 (sharepoint server) OR web apps/version office web apps sp1/sp2 Microsoft Office Web Apps 2010 Service Pack 1 is installed AND Microsoft Office Web Apps 2010 Service Pack 2 is installed AND either file versions Check if the version of msoserver.dll is less than 14.0.7106.5000 AND Check if the version of xlsrv.dll is less than 14.0.7104.5000 (web apps) OR Exchange Server 2007 and vulnerable file version Microsoft Exchange Server 2007 SP3 is installed AND Check if the version of exsetup.exe is less than 8.3.342.4 OR Exchange Server 2010 SP2 and vulnerable file version Microsoft Exchange Server 2010 SP2 is installed AND Check if the version of exsetup.exe is less than 14.2.390.3 OR Exchange Server 2010 SP3 and vulnerable file version Microsoft Exchange Server 2010 SP3 is installed AND Check if the version of exsetup.exe is less than 14.3.174.1 OR Exchange Server 2013 CU2 and vulnerable file version Microsoft Exchange Server 2013 Cumulative Update 2 is installed AND Check if the version of exsetup.exe is less than 15.0.712.31 OR Exchange Server 2013 CU3 and vulnerable file version Microsoft Exchange Server 2013 Cumulative Update 3 is installed AND Check if the version of exsetup.exe is less than 15.0.775.41

Definition Id: oval:org.mitre.oval:def:19100

Oval ID:	oval:org.mitre.oval:def:19100
Title:	Denial of service vulnerability in Microsoft SharePoint (CVE-2013-3849) - MS13-067
Description:	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3847, CVE-2013-3848, and CVE-2013-3858.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3849	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Server 2010 Microsoft Office Web Apps
Definition Synopsis:
sharepoint server 2010/version Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 OR web apps/version Microsoft Office Web Apps 2010 Service Pack 1 is installed AND Check if the version of msoserver.dll is less than 14.0.7106.5000

Definition Id: oval:org.mitre.oval:def:19136

Oval ID:	oval:org.mitre.oval:def:19136
Title:	Cross-site scripting vulnerability in Microsoft SharePoint (CVE-2013-3180) - MS13-067
Description:	Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka "POST XSS Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3180	Version:	9
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Microsoft SharePoint Foundation 2010 Microsoft SharePoint Foundation 2013 Microsoft SharePoint Server 2010 Microsoft SharePoint Server 2013
Definition Synopsis:
foundation 2010/version Check if the version of onetutil.dll is less than 14.0.7105.5000 AND foundation 2010 sp1/sp2 Microsoft SharePoint Foundation 2010 Service Pack 1 is installed AND Microsoft SharePoint Foundation 2010 Service Pack 2 is installed OR sharepoint server 2010/version sharepoint server 2010 sp1/sp2 Microsoft SharePoint Server 2010 Service Pack 1 is installed AND Microsoft SharePoint Server 2010 Service Pack 2 is installed AND either files versions Check if the version of microsoft.office.server.native.dll is less than 14.0.7005.1000 AND Check if the version of WdsrvWorker.dll is less than 14.0.6112.5000 AND Check if the version of xlsrv.dll is less than 14.0.7104.5000 (sharepoint server) OR foundation 2013/version Check if the version of Microsoft.office.server.native.dll is less than 15.0.4535.1000 AND Microsoft SharePoint Server 2013 is installed OR sharepoint foundation 2013/version Microsoft SharePoint Foundation 2013 is installed AND Check if the version of Onfda.dll is less than 15.0.4535.1000

Definition Id: oval:org.mitre.oval:def:26382

Oval ID:	oval:org.mitre.oval:def:26382
Title:	Service Control Manager Double Free Vulnerability (MS13-077)
Description:	Double free vulnerability in Microsoft Windows 7 and Server 2008 R2 SP1 allows local users to gain privileges via a crafted service description that is not properly handled by services.exe in the Service Control Manager (SCM), aka "Service Control Manager Double Free Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3862	Version:	3
Platform(s):	Microsoft Windows 7 Microsoft Windows Server 2008 R2	Product(s):
Definition Synopsis:
OS section Microsoft Windows 7 (32-bit) Service Pack 1 is installed AND Microsoft Windows 7 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed AND Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed GDR/LDR Check if the version of winsrv.dll is less than 6.1.7601.18229 OR LDR range Check if the version of winsrv.dll is less than 6.1.7601.22411 AND the version of Winsrv.dll is greater than or equal to 6.1.7601.21000

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Access cpe:2.3:a:microsoft:access:2013::::::x64: cpe:2.3:a:microsoft:access:2013:::::x86:: cpe:2.3:a:microsoft:access:2010:sp2:::::x64:* cpe:2.3:a:microsoft:access:2010:sp1:::::x64:* cpe:2.3:a:microsoft:access:2010:sp1::::x86::* cpe:2.3:a:microsoft:access:2010:sp2::::x86::* cpe:2.3:a:microsoft:access:2007:sp3::::::	7
Application	Microsoft Active Directory Lightweight Directory Service cpe:2.3:a:microsoft:active_directory_lightweight_directory_service:-:::::::*	1
Application	Microsoft Excel cpe:2.3:a:microsoft:excel:2013:::::x86:: cpe:2.3:a:microsoft:excel:2013::::::x64: cpe:2.3:a:microsoft:excel:2013:::::::* cpe:2.3:a:microsoft:excel:2010:sp1:::::: cpe:2.3:a:microsoft:excel:2010:sp1:::::x64:* cpe:2.3:a:microsoft:excel:2010:sp1::::x86::* cpe:2.3:a:microsoft:excel:2010:sp2::::x86::* cpe:2.3:a:microsoft:excel:2010:sp2:::::x64:* cpe:2.3:a:microsoft:excel:2007:sp3:::::: cpe:2.3:a:microsoft:excel:2003:sp3::::::	10
Application	Microsoft Excel Viewer cpe:2.3:a:microsoft:excel_viewer::::::::	1
Application	Microsoft Frontpage cpe:2.3:a:microsoft:frontpage:2003:sp3::::::	1
Application	Microsoft Internet Explorer cpe:2.3:a:microsoft:internet_explorer:10:::::::* cpe:2.3:a:microsoft:internet_explorer:9:::::::* cpe:2.3:a:microsoft:internet_explorer:8:::::::* cpe:2.3:a:microsoft:internet_explorer:7:::::::* cpe:2.3:a:microsoft:internet_explorer:6:::::::*	5
Application	Microsoft Office cpe:2.3:a:microsoft:office:2011::mac::::: cpe:2.3:a:microsoft:office:2010:sp1:x64:::::* cpe:2.3:a:microsoft:office:2010:sp1:::::: cpe:2.3:a:microsoft:office:2010:sp1:x86:::::* cpe:2.3:a:microsoft:office:2007:sp3:::::: cpe:2.3:a:microsoft:office:2003:sp3::::::	6
Application	Microsoft Office Compatibility Pack cpe:2.3:a:microsoft:office_compatibility_pack::sp3::::::*	1
Application	Microsoft Office Web Apps cpe:2.3:a:microsoft:office_web_apps:2010:sp2:::::: cpe:2.3:a:microsoft:office_web_apps:2010:sp1::::::	2
Application	Microsoft Outlook cpe:2.3:a:microsoft:outlook:2010:sp1:::::x64:* cpe:2.3:a:microsoft:outlook:2010:sp1::::x86::* cpe:2.3:a:microsoft:outlook:2010:sp2:::::x64:* cpe:2.3:a:microsoft:outlook:2010:sp2::::x86::* cpe:2.3:a:microsoft:outlook:2007:sp3::::::	5
Application	Microsoft Pinyin Ime cpe:2.3:a:microsoft:pinyin_ime:2010:::::x86:: cpe:2.3:a:microsoft:pinyin_ime:2010::::::x64:	2
Application	Microsoft Sharepoint Foundation cpe:2.3:a:microsoft:sharepoint_foundation:2013:::::::* cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp1:::::: cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2::::::	3
Application	Microsoft Sharepoint Portal Server cpe:2.3:a:microsoft:sharepoint_portal_server:2003:sp3::::::	1
Application	Microsoft Sharepoint Server cpe:2.3:a:microsoft:sharepoint_server:2013:::::::* cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:::::: cpe:2.3:a:microsoft:sharepoint_server:2010:sp1:::::: cpe:2.3:a:microsoft:sharepoint_server:2007:sp3::::::	4
Application	Microsoft Sharepoint Services cpe:2.3:a:microsoft:sharepoint_services:3.0:::::::* cpe:2.3:a:microsoft:sharepoint_services:2.0:::::::*	2
Application	Microsoft Word cpe:2.3:a:microsoft:word:2010:sp1:::::x64:* cpe:2.3:a:microsoft:word:2010:sp2:::::x64:* cpe:2.3:a:microsoft:word:2010:sp2::::x86::* cpe:2.3:a:microsoft:word:2010:sp1::::x86::* cpe:2.3:a:microsoft:word:2010:sp1:::::: cpe:2.3:a:microsoft:word:2007:sp3:::::: cpe:2.3:a:microsoft:word:2003:sp3::::::	7
Application	Microsoft Word Viewer cpe:2.3:a:microsoft:word_viewer::::::::	1
Os	Microsoft Windows 2003 Server cpe:2.3:o:microsoft:windows_2003_server::sp2:x64::::: cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium::::: cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*	3
Os	Microsoft Windows 7 cpe:2.3:o:microsoft:windows_7::sp1:x64::::: cpe:2.3:o:microsoft:windows_7::sp1:x86:::::	2
Os	Microsoft Windows 8 cpe:2.3:o:microsoft:windows_8:-::::pro_n::x64:* cpe:2.3:o:microsoft:windows_8:-::::pro_n::x86:*	2
Os	Microsoft Windows Rt cpe:2.3:o:microsoft:windows_rt:-:::::::*	1
Os	Microsoft Windows Server 2003 cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*	1
Os	Microsoft Windows Server 2008 cpe:2.3:o:microsoft:windows_server_2008::sp2:x86::::: cpe:2.3:o:microsoft:windows_server_2008::r2:x64::::: cpe:2.3:o:microsoft:windows_server_2008::sp2:itanium::::: cpe:2.3:o:microsoft:windows_server_2008::sp2:x64::::: cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::	5
Os	Microsoft Windows Server 2012 cpe:2.3:o:microsoft:windows_server_2012:-:::::::*	1
Os	Microsoft Windows Vista cpe:2.3:o:microsoft:windows_vista::sp2::::::*	1
Os	Microsoft Windows Xp cpe:2.3:o:microsoft:windows_xp::sp3::::::* cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*	2

SAINT Exploits

Description	Link
Internet Explorer CCaret UpdateScreenCaret Memory Corruption	More info here
Windows Crafted Theme File Handling Vulnerability	More info here

Information Assurance Vulnerability Management (IAVM)

Date	Description
2013-12-12	IAVM : 2013-A-0231 - Multiple Vulnerabilities in Microsoft Exchange Server Severity : Category I - VMSKEY : V0042592
2013-09-12	IAVM : 2013-B-0099 - Multiple Remote Code Execution Vulnerabilities in Microsoft Access Severity : Category II - VMSKEY : V0040287
2013-09-12	IAVM : 2013-A-0177 - Multiple Vulnerabilities in Red Hat JBoss Enterprise Application Platform Severity : Category I - VMSKEY : V0040288
2013-09-12	IAVM : 2013-A-0178 - Multiple Vulnerabilities in Microsoft Office Severity : Category II - VMSKEY : V0040289
2013-09-12	IAVM : 2013-A-0176 - Microsoft Windows Object Linking and Embedding (OLE) Remote Code Execution Vu... Severity : Category II - VMSKEY : V0040290
2013-09-12	IAVM : 2013-A-0174 - Multiple Remote Code Execution Vulnerabilities in Microsoft SharePoint Server Severity : Category II - VMSKEY : V0040292
2013-09-12	IAVM : 2013-A-0173 - Microsoft Outlook Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0040293
2013-09-12	IAVM : 2013-A-0171 - Multiple Remote Code Execution Vulnerabilities in Microsoft Excel Severity : Category I - VMSKEY : V0040295
2013-09-12	IAVM : 2013-B-0104 - Microsoft Windows Theme File Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0040299
2013-09-12	IAVM : 2013-B-0103 - Microsoft Windows Service Control Manager Privilege Escalation Vulnerability Severity : Category II - VMSKEY : V0040300
2013-09-12	IAVM : 2013-B-0102 - Microsoft Office Input Method Editor (IME) Privilege Escalation Vulnerability Severity : Category II - VMSKEY : V0040301
2013-09-12	IAVM : 2013-B-0101 - Microsoft FrontPage Information Disclosure Vulnerability Severity : Category I - VMSKEY : V0040302
2013-09-12	IAVM : 2013-B-0100 - Microsoft Active Directory Denial of Service Vulnerability Severity : Category I - VMSKEY : V0040303

Snort® IPS/IDS

Date	Description
2019-07-23	Microsoft Office Excel malicious cce value following a PtgMemFunc token RuleID : 50462 - Revision : 1 - Type : FILE-OFFICE
2019-07-23	Microsoft Office Excel malicious cce value following a PtgMemFunc token RuleID : 50461 - Revision : 1 - Type : FILE-OFFICE
2019-04-02	Microsoft Access arbitrary code execution attempt RuleID : 49300 - Revision : 3 - Type : FILE-OFFICE
2019-04-02	Microsoft Access arbitrary code execution attempt RuleID : 49299 - Revision : 3 - Type : FILE-OFFICE
2019-03-28	Microsoft Access arbitrary code execution attempt RuleID : 49286 - Revision : 3 - Type : FILE-OFFICE
2019-03-28	Microsoft Access arbitrary code execution attempt RuleID : 49285 - Revision : 2 - Type : FILE-OFFICE
2016-11-15	Microsoft Office Excel malicious cce value following a PtgMemFunc token RuleID : 40460 - Revision : 3 - Type : FILE-OFFICE
2016-11-15	Microsoft Office Excel malicious cce value following a PtgMemFunc token RuleID : 40459 - Revision : 3 - Type : FILE-OFFICE
2016-07-26	Microsoft Office Excel RealTimeData record exploit attempt RuleID : 39347 - Revision : 2 - Type : FILE-OFFICE
2016-07-26	Microsoft Office Excel RealTimeData record exploit attempt RuleID : 39346 - Revision : 2 - Type : FILE-OFFICE
2016-03-22	Microsoft Internet Explorer CDisplayPointer use after free attempt RuleID : 37811 - Revision : 1 - Type : BROWSER-IE
2016-03-22	Microsoft Internet Explorer CDisplayPointer use after free attempt RuleID : 37810 - Revision : 1 - Type : BROWSER-IE
2015-02-18	Microsoft Internet Explorer CTreePos Use After Free attempt RuleID : 33098 - Revision : 7 - Type : BROWSER-IE
2015-02-18	Microsoft Internet Explorer CTreePos Use After Free attempt RuleID : 33097 - Revision : 7 - Type : BROWSER-IE
2015-02-18	Microsoft Internet Explorer CTreePos Use After Free attempt RuleID : 33096 - Revision : 7 - Type : BROWSER-IE
2015-02-18	Microsoft Internet Explorer CTreePos Use After Free attempt RuleID : 33095 - Revision : 7 - Type : BROWSER-IE
2014-11-16	Microsoft Access memory corruption attempt RuleID : 31537 - Revision : 3 - Type : FILE-OFFICE
2014-11-16	Microsoft Access memory corruption attempt RuleID : 31536 - Revision : 3 - Type : FILE-OFFICE
2014-11-16	Microsoft Access memory corruption attempt RuleID : 31535 - Revision : 3 - Type : FILE-OFFICE
2014-11-16	Microsoft Access memory corruption attempt RuleID : 31534 - Revision : 3 - Type : FILE-OFFICE
2014-04-24	Microsoft Office Excel malicious cce value following a PtgMemFunc token RuleID : 30243 - Revision : 5 - Type : FILE-OFFICE
2014-04-24	Microsoft Office Excel malicious cce value following a PtgMemFunc token RuleID : 30242 - Revision : 5 - Type : FILE-OFFICE
2014-01-23	Microsoft Internet Explorer CDisplayPointer use after free attempt RuleID : 29035 - Revision : 5 - Type : BROWSER-IE
2014-01-23	Microsoft Internet Explorer CDisplayPointer use after free attempt RuleID : 29034 - Revision : 5 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer javascript call method type confusion attempt RuleID : 28232 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer javascript call method type confusion attempt RuleID : 28231 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Windows Active Directory LDAP denial of service attempt RuleID : 27860 - Revision : 3 - Type : OS-WINDOWS
2014-01-10	Microsoft Office Word malformed OCXINFO element EoP attempt RuleID : 27859 - Revision : 4 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Word malformed OCXINFO element EoP attempt RuleID : 27858 - Revision : 4 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Word document invalid cell count memory corruption attempt RuleID : 27857 - Revision : 2 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Word document invalid cell count memory corruption attempt RuleID : 27856 - Revision : 2 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Word document invalid cell count memory corruption attempt RuleID : 27855 - Revision : 3 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Word document invalid cell count memory corruption attempt RuleID : 27854 - Revision : 3 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Word invalid number of cells memory corruption attempt RuleID : 27853 - Revision : 3 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Word invalid number of cells memory corruption attempt RuleID : 27852 - Revision : 3 - Type : FILE-OFFICE
2014-01-10	Microsoft Office SDTI signed integer underflow attempt RuleID : 27851 - Revision : 5 - Type : FILE-OFFICE
2014-01-10	Microsoft Office SDTI signed integer underflow attempt RuleID : 27850 - Revision : 4 - Type : FILE-OFFICE
2014-01-10	Microsoft Internet Explorer iframe execCommand use after free attempt RuleID : 27846 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer iframe execCommand use after free attempt RuleID : 27845 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer CTreePos object use-after-free attempt RuleID : 27844 - Revision : 7 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer CTreePos object use-after-free attempt RuleID : 27843 - Revision : 6 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer CSegment object use after free attempt RuleID : 27842 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer 9 MutationEvent use after free attempt RuleID : 27841 - Revision : 6 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer range markup switch use after free attempt RuleID : 27840 - Revision : 3 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer range markup switch use after free attempt RuleID : 27839 - Revision : 3 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer CDisplayPointer use after free attempt RuleID : 27838 - Revision : 5 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer CDisplayPointer use after free attempt RuleID : 27837 - Revision : 5 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer AddOption use after free attempt RuleID : 27836 - Revision : 3 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer AddOption use after free attempt RuleID : 27835 - Revision : 3 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer javascript apply method type confusion attempt RuleID : 27834 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer javascript call method type confusion attempt RuleID : 27833 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer javascript apply method type confusion attempt RuleID : 27832 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer javascript call method type confusion attempt RuleID : 27831 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer hgroup element DOM reset use after free attempt RuleID : 27830 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer hgroup element DOM reset use after free attempt RuleID : 27829 - Revision : 2 - Type : BROWSER-IE
2014-01-10	Microsoft SharePoint self cross site scripting attempt RuleID : 27828 - Revision : 3 - Type : SERVER-WEBAPP
2014-01-10	Microsoft SharePoint self cross site scripting attempt RuleID : 27827 - Revision : 3 - Type : SERVER-WEBAPP
2014-01-10	Microsoft SharePoint self cross site scripting attempt RuleID : 27826 - Revision : 3 - Type : SERVER-WEBAPP
2014-01-10	Microsoft Office Excel invalid external defined names read AV attempt RuleID : 27825 - Revision : 2 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Excel invalid external defined names read AV attempt RuleID : 27824 - Revision : 2 - Type : FILE-OFFICE
2014-01-10	Microsoft Office SharePoint malicious serialized viewstate evaluation attempt RuleID : 27823 - Revision : 3 - Type : SERVER-WEBAPP
2014-01-10	Microsoft Windows XP .theme file remote code execution attempt RuleID : 27822 - Revision : 9 - Type : FILE-OTHER
2014-01-10	Microsoft Office Excel PtgMemFunc zero-value cce-field read access violation ... RuleID : 27821 - Revision : 4 - Type : FILE-OFFICE
2014-01-10	Microsoft Office Excel PtgMemFunc zero-value cce-field read access violation ... RuleID : 27820 - Revision : 4 - Type : FILE-OFFICE
2014-01-10	Microsoft SharePoint denial of service attempt RuleID : 27819 - Revision : 3 - Type : SERVER-OTHER
2014-01-10	Microsoft SharePoint denial of service attempt RuleID : 27818 - Revision : 3 - Type : SERVER-OTHER
2014-01-10	XML parameter entity reference local file disclosure attempt RuleID : 26626 - Revision : 6 - Type : FILE-OFFICE

Nessus® Vulnerability Scanner

Date	Description
2013-12-11	Name : The remote mail server has multiple vulnerabilities. File : smb_nt_ms13-105.nasl - Type : ACT_GATHER_INFO
2013-09-17	Name : The version of Microsoft Office installed on the remote Windows host has a pr... File : smb_nt_ms13-075.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : An application installed on the remote Mac OS X host is affected by multiple ... File : macosx_ms13-073.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The remote host is affected by multiple vulnerabilities. File : smb_nt_ms13-067.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The version of Microsoft Office installed on the remote Windows is affected b... File : smb_nt_ms13-068.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The remote host is affected by multiple code execution vulnerabilities. File : smb_nt_ms13-069.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The remote Windows host is affected by a code execution vulnerability. File : smb_nt_ms13-070.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The remote Windows host is affected by a code execution vulnerability. File : smb_nt_ms13-071.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The Microsoft Office component installed on the remote host is affected by mu... File : smb_nt_ms13-072.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : It is possible to execute arbitrary code on the remote host through Microsoft... File : smb_nt_ms13-073.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : It is possible to execute arbitrary code on the remote host through Microsoft... File : smb_nt_ms13-074.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The Windows kernel on the remote host is affected by multiple vulnerabilities. File : smb_nt_ms13-076.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The remote host is affected by a privilege escalation vulnerability. File : smb_nt_ms13-077.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The remote host is affected by an information disclosure vulnerability. File : smb_nt_ms13-078.nasl - Type : ACT_GATHER_INFO
2013-09-11	Name : The remote host is affected by an Active Directory denial of service vulnerab... File : smb_nt_ms13-079.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-10-11 13:31:26	Multiple Updates
2013-09-11 05:19:27	First insertion

Global Informations

Type	Count
CWE ID(s)	47
Oval ID(s)	51
CPE ID(s)	77
Saint Exploit(s)	2
IAVM(s)	13
Snort® Rule(s)	67
Nessus® Exploit(s)	15

	Related
10	CVE-2013-1330
9.3	CVE-2013-3870
9.3	CVE-2013-3863
9.3	CVE-2013-3858
9.3	CVE-2013-3857
9.3	CVE-2013-3856
9.3	CVE-2013-3855
9.3	CVE-2013-3854
9.3	CVE-2013-3853
9.3	CVE-2013-3852
9.3	CVE-2013-3851
9.3	CVE-2013-3850
9.3	CVE-2013-3849
9.3	CVE-2013-3848
9.3	CVE-2013-3847
9.3	CVE-2013-3845
9.3	CVE-2013-3209
9.3	CVE-2013-3208
9.3	CVE-2013-3207
9.3	CVE-2013-3206
9.3	CVE-2013-3205
9.3	CVE-2013-3204
9.3	CVE-2013-3203
9.3	CVE-2013-3202
9.3	CVE-2013-3201
9.3	CVE-2013-3158
9.3	CVE-2013-3157
9.3	CVE-2013-3156
9.3	CVE-2013-3155
9.3	CVE-2013-1315
9.3	CVE-2013-0810
7.2	CVE-2013-3866
7.2	CVE-2013-3865
7.2	CVE-2013-3864
7.2	CVE-2013-1344
7.2	CVE-2013-1343
7.2	CVE-2013-1342
7.2	CVE-2013-1341
6.9	CVE-2013-3862
6.9	CVE-2013-3859
5	CVE-2013-3868
5	CVE-2013-3160
5	CVE-2013-0081
4.3	CVE-2013-3180
4.3	CVE-2013-3179
4.3	CVE-2013-3159
4.3	CVE-2013-3137
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 47 more Alert(s)