Posts tagged CVE-2013-1303

Microsoft May 2013 Patch Tuesday Review

Microsoft has release, May 14th 2013, during his May Patch Tuesday, two updated security advisories, two new security advisories and ten security bulletins. On the ten security bulletins two of them have a Critical security rating.

Microsoft Security Advisory 2755801

MSA-2755801,released during September 2012, has been updated. The security advisory is regarding updates for vulnerabilities in Adobe Flash Player in Internet Explorer 10. KB2840613 has been released for supported editions of Windows 8, Windows Server 2012, and Windows RT. The update addresses the vulnerabilities described in Adobe Security bulletin APSB13-14.

Microsoft Security Advisory 2820197

MSA-2820197 update includes kill bits to prevent Honeywell Enterprise Buildings Integrator and SymmetrE and ComfortPoint Open Manager ActiveX controls from being run in Internet Explorer.

Microsoft Security Advisory 2846338

MSA-2846338 concern a privately reported security vulnerability, CVE-2013-1303 (9.3 CVSS base score), in Microsoft Malware Protection Engine that could allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file. This vulnerability has been publicly disclosed as a denial of service. Only x64-based versions of the Malware Protection Engine are affected.

Microsoft Security Advisory 2847140

MSA-2847140, released May 3rd 2013, has been updated. The security advisory concern Microsoft Internet Explorer 8 remote code execution vulnerability (CVE-2013-1347) used in targeted attacks against United States Department of Labor (DOL) Site Exposure Matrices (SEM) and other websites. Microsoft has issue MS13-038 to address the vulnerability.

MS13-037 Cumulative Security Update for Internet Explorer

MS13-037 security update, classified as Critical, allowing remote code execution, is the fix for 11 privately reported vulnerabilities in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10. CVE-2013-1297 (4.3 CVSS base score) was discovered and privately reported by Yosuke Hasegawa. CVE-2013-0811 (9.3 CVSS base score) was discovered and privately reported by Jose Antonio Vazquez Gonzalez, working with VeriSign iDefense Labs. CVE-2013-1306 (9.3 CVSS base score) and CVE-2013-1309 (9.3 CVSS base score) were discovered and privately reported by SkyLined, working with HP’s Zero Day Initiative. CVE-2013-1307 (9.3 CVSS base score) was discovered and privately reported by Ivan Fratric of the Google Security Team. CVE-2013-1308 (9.3 CVSS base score) was discovered and privately reported by [email protected], working with HP’s Zero Day Initiative. CVE-2013-1310 (9.3 CVSS base score) was discovered and privately reported by Yuhong Bao. CVE-2013-1311 (9.3 CVSS base score) was discovered and privately reported by Scott Bell of Security-Assessment.com. CVE-2013-1312 (9.3 CVSS base score) was discovered and privately reported by Stephen Fewer of Harmony Security. CVE-2013-1313 (9.3 CVSS base score) was discovered and privately reported by VUPEN Security (Pwn2Own 2013), working with HP’s Zero Day Initiative.

MS13-038 Security Update for Internet Explorer

MS13-038 security update, classified as Critical, allowing remote code execution, is the fix for one publicly disclosed vulnerability in Internet Explorer 8. CVE-2013-1347 (9.3 CVSS base score), was discovered exploited in the wild in targeted attacks.

MS13-039 Vulnerability in HTTP.sys Could Allow Denial of Service

MS13-039 security update, classified as Important, allowing denial of service, is the fix for one privately reported vulnerability in Microsoft Windows. CVE-2013-1305 (5.0 CVSS base score) was discovered and privately reported by Marek Kroemeke, 22733db72ab3ed94b5f8a1ffcde850251fe6f466, AKAT-1, working with HP’s Zero Day Initiative.

MS13-040 Vulnerabilities in .NET Framework Could Allow Spoofing

MS13-040 security update, classified as Important, allowing spoofing, is the fix for one privately reported vulnerability and one publicly disclosed vulnerability in .NET Framework. CVE-2013-1336 (5.0 CVSS base score) was discovered and privately reported by James Forshaw of Context Information Security. CVE-2013-1337 (7.5 CVSS base score) was publicly disclosed.

MS13-041 Vulnerability in Lync Could Allow Remote Code Execution

MS13-041 security update, classified as Important, allowing remote code execution, is the fix for one privately reported vulnerability in Microsoft Lync. CVE-2013-1302 (9.3 CVSS base score) was discovered and privately reported.

MS13-042 Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution

MS13-042 security update, classified as Important, allowing remote code execution, is the fix for 11 privately reported vulnerabilities in Microsoft Office. CVE-2013-1316 (9.3 CVSS base score), CVE-2013-1317 (9.3 CVSS base score), CVE-2013-1318 (10.0 CVSS base score), CVE-2013-1319 (10.0 CVSS base score), CVE-2013-1320 (10.0 CVSS base score), CVE-2013-1321 (9.3 CVSS base score), CVE-2013-1322 (10.0 CVSS base score), CVE-2013-1323 (9.3 CVSS base score), CVE-2013-1327 (9.3 CVSS base score), CVE-2013-1328 (9.3 CVSS base score) and CVE-2013-1329 (9.3 CVSS base score) were discovered and privately reported by Will Dormann of the CERT/CC.

MS13-043 Vulnerability in Microsoft Word Could Allow Remote Code Execution

MS13-043 security update, classified as Important, allowing remote code execution, is the fix for one privately reported vulnerability in Microsoft Office. CVE-2013-1335 (9.3 CVSS base score) was discovered and privately reported by Will Dormann of the CERT/CC.

MS13-044 Vulnerability in Microsoft Visio Could Allow Information Disclosure

MS13-044 security update, classified as Important, allowing information disclosure, is the fix for one privately reported vulnerability in Microsoft Office. CVE-2013-1301 (4.3 CVSS base score) was discovered and privately reported by Timur Yunusov of Positive Technologies.

MS13-045 Vulnerability in Windows Essentials Could Allow Information Disclosure

MS13-045 security update, classified as Important, allowing information disclosure, is the fix for one privately reported vulnerability in Windows Essentials. CVE-2013-0096 (6.8 CVSS base score) was discovered and privately reported by Andrea Micalizzi, working with Beyond Security’s SecuriTeam Secure Disclosure team.

MS13-046 Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation Of Privilege

MS13-046 security update, classified as Important, allowing elevation of privilege, is the fix for three privately reported vulnerabilities in Microsoft Windows. CVE-2013-1332 (7.2 CVSS base score) was discovered and privately reported by Gynvael Coldwind and Mateusz “j00ru” Jurczyk of Google Inc. CVE-2013-1333 (7.2 CVSS base score) was discovered and privately reported by Qihoo 360 Security Center. CVE-2013-1334 (7.2 CVSS base score) was discovered and privately reported by an anonymous researcher, working with the iDefense VCP.

Microsoft April 2013 Patch Tuesday Review

Microsoft has release, the 9 April 2013, during his April Patch Tuesday, one updated security advisory and nine security bulletins. On the nine security bulletins two of them have a Critical security rating.

Microsoft Security Advisory 2755801

MSA-2755801,released during September 2012, has been updated. The security advisory is regarding updates for vulnerabilities in Adobe Flash Player in Internet Explorer 10. KB2833510 has been released for supported editions of Windows 8, Windows Server 2012, and Windows RT. The update addresses the vulnerabilities described in Adobe Security bulletin APSB13-11.

MS13-028 – Cumulative Security Update for Internet Explorer

MS13-028 security update, classified as Critical, allowing remote code execution, is the fix for 2 privately reported vulnerabilities in Internet Explorer. CVE-2013-1303 (6.8 CVSS base score) and CVE-2013-1304 (6.8 CVSS base score) were discovered and privately reported by Ivan Fratric and Ben Hawkes of Google Security Team.

MS13-029 – Vulnerability in Remote Desktop Client Could Allow Remote Code Execution

MS13-029 security update, classified as Critical, allowing remote code execution, is the fix for 1 privately reported vulnerability in Windows Remote Desktop Client. CVE-2013-1296 (9.3 CVSS base score) was discovered and privately reported by c1d2d9acc746ae45eeb477b97fa74688, working with HP’s Zero Day Initiative.

MS13-030 – Vulnerability in SharePoint Could Allow Information Disclosure

MS13-030 security update, classified as Important, allowing information disclosure, is the fix for 1 publicly reported vulnerability in Microsoft SharePoint Server. CVE-2013-1290 (3.5 CVSS base score) was publicly disclosed.

MS13-031 – Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege

MS13-031 security update, classified as Important, allowing elevation of privileges, is the fix for 2 privately reported vulnerabilities in Microsoft Windows. CVE-2013-1284 (4.9 CVSS base score) and CVE-2013-1294 (4.9 CVSS base score) were discovered and privately reported by Gynvael Coldwind and Mateusz “j00ru” Jurczyk of Google Inc.

MS13-032 – Vulnerability in Active Directory Could Lead to Denial of Service

MS13-032 security update, classified as Important, allowing denial of service, is the fix for 1 privately reported vulnerability in Active Directory. CVE-2013-1282 (unknown CVSS base score) was discovered and privately reported.

MS13-033 – Vulnerability in Windows Client/Server Run-time Subsystem (CSRSS) Could Allow Elevation of Privilege

MS13-033 security update, classified as Important, allowing elevation of privileges, is the fix for 1 privately reported vulnerability. CVE-2013-1295 (5.0 CVSS base score) was discovered and privately reported by George Georgiev Valkov.

MS13-034 – Vulnerability in Microsoft Antimalware Client Could Allow Elevation of Privilege

MS13-034 security update, classified as Important, allowing elevation of privileges, is the fix for 1 privately reported vulnerability in the Microsoft Antimalware Client. CVE-2013-0078 (7.2 CVSS base score) was discovered and privately reported.

MS13-035 – Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege

MS13-035 security update, classified as Important, allowing elevation of privileges, is the fix for 1 privately reported vulnerability in the Microsoft Office. CVE-2013-1289 (4.3 CVSS base score) was discovered and privately reported by Drew Hintz of Google Security Team.

MS13-036 – Vulnerabilities in Kernel-Mode Driver Could Allow Elevation Of Privilege

MS13-036 security update, classified as Important, allowing elevation of privileges, is the fix for three privately reported vulnerabilities and one publicly disclosed vulnerability in Microsoft Windows. CVE-2013-1283 (6.9 CVSS base score) and CVE-2013-1292 (6.9 CVSS base score) were discovered and privately reported by Gynvael Coldwind and Mateusz “j00ru” Jurczyk of Google IncCVE-2013-1293 (6.9 CVSS base score) was publicly disclosed by Gynvael Coldwind and Mateusz “j00ru” Jurczyk of Google IncCVE-2013-1291 (7.1 CVSS base score) was discovered and privately reported by Wang Yu.

Go to Top