Exploited
CWE
94
Advisory Published
Updated

CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability

First published: Wed Nov 06 2013(Updated: )

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

Credit: secure@microsoft.com secure@microsoft.com secure@microsoft.com

Affected SoftwareAffected VersionHow to fix
Microsoft Graphics Component
Microsoft Office=2003-sp3
Microsoft Office=2007-sp3
Microsoft Office=2010-sp1
Microsoft Office=2010-sp1
Microsoft Office=2010-sp2
Microsoft Office=2010-sp2
Microsoft Windows Vista=sp2
Microsoft Windows Vista=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Lync=2010
Microsoft Lync=2010
Microsoft Lync=2010
Microsoft Lync=2013
Microsoft Lync=2013
Microsoft Lync Basic=2013
Microsoft Lync Basic=2013
Microsoft Excel Viewer
Microsoft Lync=2010
Microsoft Lync=2013
Microsoft Office=2010-sp1
Microsoft Office=2010-sp2
Microsoft Office Compatibility Pack=sp3
Microsoft PowerPoint Viewer=2010-sp1
Microsoft PowerPoint Viewer=2010-sp2
Microsoft Word Viewer
Microsoft Windows Server 2008=sp2
Microsoft Windows Vista=sp2

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203