high7.8Known exploitedPublic exploit code
CVE-2013-0074
Microsoft Silverlight Double Dereference Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-05-25. Federal due date: 2022-06-15.
The impacted product is end-of-life and should be disconnected if still in use.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)2013-03-12 · local · windows · Verified
- Microsoft Internet Explorer - COALineDashStyleArray Unsafe Memory Access (MS12-022) (Metasploit)2013-11-27 · remote · windows · Verified
Impact
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Silverlight | from 5.0 before 5.1.20125.0 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://www.us-cert.gov/ncas/alerts/TA13-071A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16516
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16565
- http://www.us-cert.gov/ncas/alerts/TA13-071A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16516
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16565
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0074