CVE-2013-0007: Code Injection
Published Jan 9, 2013
·Updated
Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."
Affected Software
64 affected components
All of the following
Any of the following
Microsoft XML Core Services=3.0
Microsoft XML Core Services=4.0
Microsoft XML Core Services=6.0
Any of the following
Microsoft Windows 7
Microsoft Windows 7=sp1
Microsoft Windows 8
Microsoft Windows Server 2003=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=r2
Microsoft Windows Server 2012
Microsoft Windows Vista=sp2
Microsoft Windows XP=sp2
All of the following
Any of the following
Microsoft XML Core Services=4.0
Microsoft XML Core Services=6.0
Any of the following
Microsoft Windows 7
Microsoft Windows RT
Microsoft Windows Server 2003=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Vista=sp2
Microsoft Windows XP=sp3
All of the following
Microsoft XML Core Services=5.0
Any of the following
Microsoft Expression Web=sp1
Microsoft Expression Web=2
Microsoft Groove Server=2007-sp2
Microsoft Groove Server=2007-sp3
Microsoft Office=2003-sp3
Microsoft Office=2007-sp2
Microsoft Office=2007-sp3
Microsoft Office Compatibility Pack=sp2
Microsoft Office Compatibility Pack=sp3
Microsoft SharePoint Server=2007-sp2
Microsoft SharePoint Server=2007-sp3
Microsoft Word Viewer
Microsoft XML Core Services=3.0
Microsoft XML Core Services=4.0
Microsoft XML Core Services=6.0
Microsoft Windows 7
Microsoft Windows 7=sp1
Microsoft Windows 8
Microsoft Windows Server 2003=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=r2
Microsoft Windows Server 2012
Microsoft Windows Vista=sp2
Microsoft Windows XP=sp2
Microsoft Windows RT
Microsoft Windows Server 2008=sp2
Microsoft Windows Vista=sp2
Microsoft Windows XP=sp3
Microsoft XML Core Services=5.0
Microsoft Expression Web=sp1
Microsoft Expression Web=2
Microsoft Groove Server=2007-sp2
Microsoft Groove Server=2007-sp3
Microsoft Office=2003-sp3
Microsoft Office=2007-sp2
Microsoft Office=2007-sp3
Microsoft Office Compatibility Pack=sp2
Microsoft Office Compatibility Pack=sp3
Microsoft SharePoint Server=2007-sp2
Microsoft SharePoint Server=2007-sp3
Microsoft Word Viewer
Event History
Jan 9, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-0007?
CVE-2013-0007 has a critical severity rating due to its potential for remote code execution.
2
How do I fix CVE-2013-0007?
To fix CVE-2013-0007, apply the latest security updates or patches provided by Microsoft.
3
Which versions of Microsoft XML Core Services are affected by CVE-2013-0007?
CVE-2013-0007 affects Microsoft XML Core Services versions 3.0, 4.0, 5.0, and 6.0.
4
Can CVE-2013-0007 be exploited via web browsers?
Yes, CVE-2013-0007 can be exploited by attackers through specially crafted web pages viewed in affected web browsers.
5
Is there a known workaround for CVE-2013-0007 if I cannot apply the patch?
A known workaround for CVE-2013-0007 is to disable Microsoft XML Core Services in your system settings until the patch is applied.