Vulnerability Details CVE-2013-0074
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.931
EPSS Ranking 99.8%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 9.3
Proposed Action
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
Ransomware Campaign
Known
References
- http://www.us-cert.gov/ncas/alerts/TA13-071A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16516
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16565
- http://www.us-cert.gov/ncas/alerts/TA13-071A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16516
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16565
Products affected by CVE-2013-0074
-
cpe:2.3:a:microsoft:silverlight:5.0
-
cpe:2.3:a:microsoft:silverlight:5.0.60401.0
-
cpe:2.3:a:microsoft:silverlight:5.0.60818.0
-
cpe:2.3:a:microsoft:silverlight:5.0.61118.0
-
cpe:2.3:a:microsoft:silverlight:5.1.10411.0