PT-2013-1348 · Microsoft · Office

Published 2013-06-11 · Updated 2025-04-04 · CVE-2013-1331

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2003 SP3 and 2011 for Mac

Description The issue is related to a buffer overflow in Microsoft Office, allowing remote attackers to execute arbitrary code via crafted PNG data in an Office document. This leads to improper memory allocation. An attacker who successfully exploits this vulnerability could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users operating with administrative user rights.

Recommendations For Microsoft Office 2003 SP3, update to a version that is not affected by this issue. For Microsoft Office 2011 for Mac, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of specially crafted Office files until a patch is available. Restrict access to sensitive data and systems to minimize the risk of exploitation.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2022-03965

CVE-2013-1331

Affected Products

Office

References · 12

• https://bdu.fstec.ru/vul/2022-03965 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1331 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1331 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16732 · Note
• https://otx.alienvault.com/indicator/cve/CVE-2013-1331 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16713 · Note
• http://us-cert.gov/ncas/alerts/TA13-168A · Note
• https://t.me/cvenotify/117786 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-051 · Note