Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2013-3906
HistoryNov 06, 2013 - 3:55 p.m.

CVE-2013-3906

2013-11-0615:55:05
CWE-94
[email protected]
web.nvd.nist.gov
3

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.5 High

AI Score

Confidence

Low

0.97 High

EPSS

Percentile

99.8%

JSON

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Affected configurations

NVD
Node
microsoftofficeMatch2003sp3
OR
microsoftofficeMatch2007sp3
OR
microsoftofficeMatch2010sp1x64
OR
microsoftofficeMatch2010sp1x86
OR
microsoftofficeMatch2010sp2x64
OR
microsoftofficeMatch2010sp2x86
Node
microsoftwindows_vistasp2
Node
microsoftwindows_server_2008sp2itanium
OR
microsoftwindows_server_2008sp2x64
OR
microsoftwindows_server_2008sp2x86
Node
microsoftlyncMatch2010attendee
OR
microsoftlyncMatch2010x64
OR
microsoftlyncMatch2010x86
OR
microsoftlyncMatch2013-x64
OR
microsoftlyncMatch2013-x86
OR
microsoftlync_basicMatch2013-x64
OR
microsoftlync_basicMatch2013-x86

Related

mskb 1
cisa_kev 1
thn 6
cvelist 1
attackerkb 1
symantec 1
openvas 3
metasploit 1
nessus 2
zdt 2
seebug 1
cve 1
threatpost 3
checkpoint_advisories 1
msrc 1
packetstorm 1
prion 1
exploitdb 1
talosblog 1
cisa 1
securityvulns 1
myhack58 1
qualysblog 1
mskb
mskb
MS13-096: Vulnerability in Microsoft Graphics component could allow remote code execution: December 10, 2013
2013-12-10 00:00:00
cisa_kev
cisa_kev
Microsoft Graphics Component Memory Corruption Vulnerability
2022-02-15 00:00:00
thn
thn
Internet Explorer zero-day vulnerability actively being exploited in the wild
2013-11-11 15:56:00
Microsoft set to deliver Patches for three Critical flaws, but no patch for Office Zero-day vulnerability
2013-11-09 17:15:00
Microsoft set to deliver Patches for three Critical flaws, but no patch for Office Zero-day vulnerability
2013-11-09 06:15:00
cvelist
cvelist
CVE-2013-3906
2013-11-06 11:00:00
attackerkb
attackerkb
Microsoft Tagged Image File Format Heap Overflow
2013-11-06 00:00:00
symantec
symantec
Multiple Microsoft Products CVE-2013-3906 Remote Code Execution Vulnerability
2013-11-05 00:00:00
openvas
openvas
Microsoft Lync Remote Code Execution Vulnerability (2908005)
2013-12-11 00:00:00
Microsoft Office Remote Code Execution Vulnerability (2908005)
2013-12-11 00:00:00
Microsoft Lync Attendee Remote Code Execution Vulnerability (2908005)
2013-12-11 00:00:00
metasploit
metasploit
MS13-096 Microsoft Tagged Image File Format (TIFF) Integer Overflow
2013-11-22 08:25:09
nessus
nessus
MS KB2896666: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution (deprecated)
2013-11-06 00:00:00
MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution (2908005)
2013-12-11 00:00:00
zdt
zdt
Microsoft Tagged Image File Format (TIFF) Integer Overflow
2013-11-27 00:00:00
Microsoft Tagged Image File Format (TIFF) Integer Overflow Vulnerability
2013-12-03 00:00:00
seebug
seebug
Microsoft Tagged Image File Format (TIFF) Integer Overflow
2014-07-01 00:00:00
cve
cve
CVE-2013-3906
2013-11-06 15:55:05
threatpost
threatpost
11 China APTs Linked by Central Arms Dealer Infrastructure
2013-11-14 16:02:49
Attacks on New Microsoft Zero Day Using Multi-Stage Malware
2013-11-06 11:21:12
Cybercrooks Frame Targets by Planting Fabricated Digital Evidence
2022-02-11 19:57:34
checkpoint_advisories
checkpoint_advisories
Microsoft Office Embedded TIFF Image Remote Code Execution (CVE-2013-3906)
2013-11-06 00:00:00
msrc
msrc
CVE-2013-3906: a graphics vulnerability exploited through Word documents
2013-11-05 08:00:00
packetstorm
packetstorm
Microsoft Tagged Image File Format (TIFF) Integer Overflow
2013-11-27 00:00:00
prion
prion
Design/Logic Flaw
2013-11-06 15:55:00
exploitdb
exploitdb
Microsoft - Tagged Image File Format '.TIFF' Integer Overflow (Metasploit)
2013-12-03 00:00:00
talosblog
talosblog
Modified Zyklon and plugins from India
2017-05-23 06:05:00
cisa
cisa
CISA Adds Nine Known Exploited Vulnerabilities to Catalog
2022-02-15 00:00:00
securityvulns
securityvulns
Microsoft Windows multiple security vulnerabilities
2013-12-30 00:00:00
myhack58
myhack58
The macro perspective of the office vulnerability, 2010-2018-a vulnerability warning-the black bar safety net
2019-06-13 00:00:00
qualysblog
qualysblog
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.5 High

AI Score

Confidence

Low

0.97 High

EPSS

Percentile

99.8%

JSON
Related for NVD:CVE-2013-3906
mskb1cisa_kev1thn6cvelist1attackerkb1symantec1openvas3metasploit1nessus2zdt2seebug1cve1threatpost3checkpoint_advisories1msrc1packetstorm1prion1exploitdb1talosblog1cisa1securityvulns1myhack581qualysblog1