Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2013-3660
HistoryMay 24, 2013 - 8:55 p.m.

CVE-2013-3660

2013-05-2420:55:01
CWE-119
[email protected]
web.nvd.nist.gov
854
In Wild
cve-2013-3660
epathobj
pprflattenrec
win32k.sys
vulnerability
microsoft
windows xp
windows server 2003
windows vista
windows server 2008
windows 7
windows 8
windows server 2012
privilege escalation

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.5 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.0%

JSON

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka “Win32k Read AV Vulnerability.”

Affected configurations

NVD
Node
microsoftwindows_7sp1x86
OR
microsoftwindows_8Match--x86
OR
microsoftwindows_server_2003sp2
OR
microsoftwindows_server_2008sp2
OR
microsoftwindows_server_2008Matchr2sp1
OR
microsoftwindows_server_2012Match-
OR
microsoftwindows_vistasp2
OR
microsoftwindows_xpsp2
OR
microsoftwindows_xpsp3

Related

thn 3
threatpost 2
seebug 1
attackerkb 1
metasploit 1
cisa_kev 1
msrc 1
nvd 2
prion 2
cvelist 1
packetstorm 1
nessus 2
cve 1
exploitdb 1
ibm 1
openvas 2
securityvulns 1
thn
thn
Beware! Cyber Criminals Spreading Click Fraud Trojan for Making Money
2014-05-11 04:42:00
Microsoft to patch Six critical Remote Code Execution vulnerabilities this Tuesday
2013-07-07 19:41:00
Microsoft to patch Six critical Remote Code Execution vulnerabilities this Tuesday
2013-07-07 08:41:00
threatpost
threatpost
July 2013 Microsoft Patch Tuesday Security Updates
2013-07-08 09:45:16
TrueType Font Flaws in July 2013 Microsoft Patch Tuesday
2013-07-09 16:03:22
seebug
seebug
Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation
2014-07-01 00:00:00
attackerkb
attackerkb
CVE-2013-3660
2013-05-24 00:00:00
metasploit
metasploit
Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation
2013-09-12 19:36:01
cisa_kev
cisa_kev
Microsoft Win32k Privilege Escalation Vulnerability
2022-03-28 00:00:00
msrc
msrc
Advance Notification Service for July 2013 Security Bulletin Release
2013-07-04 07:00:00
nvd
nvd
CVE-2013-3660
2013-05-24 20:55:01
CVE-2013-3130
2013-05-30 14:55:01
prion
prion
Design/Logic Flaw
2013-05-24 20:55:00
Design/Logic Flaw
2013-05-30 14:55:00
cvelist
cvelist
CVE-2013-3660
2013-05-24 20:00:00
packetstorm
packetstorm
Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation
2013-07-01 00:00:00
nessus
nessus
Microsoft Windows Kernel Win32k.sys PATHRECORD chain Multiple Vulnerabilities
2013-06-12 00:00:00
MS13-053: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (2850851)
2013-07-10 00:00:00
cve
cve
CVE-2013-3130
2022-10-03 16:14:45
exploitdb
exploitdb
Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)
2013-07-02 00:00:00
ibm
ibm
Security Bulletin: Libxml2 vulnerabilities in Network Intrusion Prevention System (CVE-2014-0191, CVE-2013-2877, CVE-2014-3660, CVE-2013-5211)
2022-02-23 19:48:26
openvas
openvas
MS Windows Kernel-Mode Drivers Remote Code Execution Vulnerabilities (2850851)
2013-07-10 00:00:00
Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerabilities (2850851)
2013-07-10 00:00:00
securityvulns
securityvulns
Microsoft Windows multiple security vulnerabilities
2013-07-29 00:00:00

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.5 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.0%

JSON
Related for CVE-2013-3660
thn3threatpost2seebug1attackerkb1metasploit1cisa_kev1msrc1nvd2prion2cvelist1packetstorm1nessus2cve1exploitdb1ibm1openvas2securityvulns1