PT-2013-2058 · Microsoft · Xml Core Services+2

Published 2013-01-09 · Updated 2023-12-07 · CVE-2013-0007

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions 4.0 through 6.0

Description A remote code execution issue exists due to improper parsing of XML content, allowing attackers to execute arbitrary code via a crafted web page. This may corrupt memory, enabling an attacker to execute code in the context of the current user.

Recommendations For Microsoft XML Core Services versions 4.0 through 6.0, update to a version that properly parses XML content to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-0007

Affected Products

Xml Core Services

Office

Sharepoint Server

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0007 · Security Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-002 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0007 · Note
• http://us-cert.gov/cas/techalerts/TA13-008A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15458 · Note