PT-2013-2057 · Microsoft · Xml Core Services+2

Published 2013-01-09 · Updated 2025-01-16 · CVE-2013-0006

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions 3.0 through 6.0

Description The issue arises from the improper parsing of XML content, allowing remote attackers to execute arbitrary code via a crafted web page. This can corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user.

Recommendations For Microsoft XML Core Services versions 3.0 through 6.0, update to a version that properly parses XML content to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2013-0006

Affected Products

Xml Core Services

Office

Sharepoint Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2013-0006 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0006 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/ms13-002 · Note
• https://t.me/cvenotify/107704 · Telegram Post
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16429 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0006 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-315-01 · Note
• http://us-cert.gov/cas/techalerts/TA13-008A.html · Note