CVE Feed

    Dashboard / CVE / CVE-2013-3906

    CVE-2013-3906

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

    Published:Nov 6, 2013
    Last Modified:Apr 22, 2026
    EPS:Nov 6, 2013
    EPSS Score:0.92628
    CVSS Score:7.8

    CISA Notification

    Description

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    Aug 15, 2022
    1488 days ago
    Alert Date
    Feb 15, 2022
    1669 days ago

    Affected Products

    Vendor
    Microsoft
    Product
    Excel Viewer
    Vendor
    Microsoft
    Product
    Lync
    Vendor
    Microsoft
    Product
    Office
    Vendor
    Microsoft
    Product
    Office Compatibility Pack
    Vendor
    Microsoft
    Product
    Powerpoint Viewer
    Vendor
    Microsoft
    Product
    Windows Server 2008
    Vendor
    Microsoft
    Product
    Windows Vista
    Vendor
    Microsoft
    Product
    Word Viewer

    Exploits

    http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspxhttp://www.exploit-db.com/exploits/30011http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspxhttp://www.exploit-db.com/exploits/30011https://www.exploit-db.com/exploits/30011

    Related CVEs

    CVE-2019-0669 (CVSS 6.5) — An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its m…
    CVE-2019-0540 (CVSS 5.5) — A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could …
    CVE-2019-0541 (CVSS 8.8) — A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka…
    CVE-2018-8627 (CVSS 5.5) — An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to …
    CVE-2018-8577 (CVSS 7.8) — A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly h…
    CVE-2018-8432 (CVSS 7.8) — A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in m…
    CVE-2018-8427 (CVSS 5.5) — An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in…
    CVE-2018-8429 (CVSS 5.5) — An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its m…
    CVE-2018-8378 (CVSS 5.5) — An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to…
    CVE-2018-8382 (CVSS 5.5) — An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its m…

    References

    http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2
    http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx
    http://technet.microsoft.com/security/advisory/2896666
    http://www.exploit-db.com/exploits/30011
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096
    http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2
    http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx
    http://technet.microsoft.com/security/advisory/2896666
    http://www.exploit-db.com/exploits/30011
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3906

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High