NetSight
IP …
medium4.9Public exploit code

CVE-2013-3661

The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 S…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.

Affected products

VendorProductAffected versions
MicrosoftWindows 7
All versions
MicrosoftWindows 8
All versions
MicrosoftWindows Rt
All versions
MicrosoftWindows Server 2003
All versions
MicrosoftWindows Server 2008
All versions
Version r2
MicrosoftWindows Server 2012
All versions
MicrosoftWindows Vista
All versions
MicrosoftWindows Xp
All versions

Weakness classification

CWE-22

References