PT-2013-4202 · Microsoft · Silverlight

Vitaliy Toropov · Published 2013-07-10 · Updated 2018-10-12 · CVE-2013-3178

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Silverlight versions prior to 5.1.20513.0

Description The issue is related to improper array initialization, which can be exploited by remote attackers to execute arbitrary code or cause a denial of service through a NULL pointer dereference. This can be achieved via a crafted Silverlight application.

Recommendations For versions prior to 5.1.20513.0, update to version 5.1.20513.0 or later to resolve the issue.

Fix

RCE

DoS

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-3178

Affected Products

Silverlight

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3178 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17389 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3178 · Note
• http://us-cert.gov/ncas/alerts/TA13-190A · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16892 · Note
• http://securitytracker.com/id/1028755 · Note