CVE-2013-3128

The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5, allow remote attackers to execute arbitrary code via a crafted OpenType font (OTF) file, aka "OpenType Font Parsing Vulnerability."

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.us-cert.gov/ncas/alerts/TA13-288A	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081	Patch Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18847	Third Party Advisory
http://www.us-cert.gov/ncas/alerts/TA13-288A	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081	Patch Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18847	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_7:-:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_7:-:sp1:::::x86:*
	cpe:2.3:o:microsoft:windows_8:-::::::x64:
	cpe:2.3:o:microsoft:windows_8:-::::::x86:
	cpe:2.3:o:microsoft:windows_rt:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2003:-:sp2::::::
	cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::itanium:*
	cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::itanium:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::itanium:*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
	cpe:2.3:o:microsoft:windows_vista:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_xp:-:sp2:::professional::x64:
	cpe:2.3:o:microsoft:windows_xp:-:sp3::::::

Configuration 2 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2003:-:sp2::::::
	cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
	cpe:2.3:o:microsoft:windows_vista:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_xp:-:sp2:::professional::x64:
	cpe:2.3:o:microsoft:windows_xp:-:sp3::::::

Configuration 3 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_8:-::::::x64:
	cpe:2.3:o:microsoft:windows_8:-::::::x86:
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*

Configuration 4 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_7:-:sp1:::::x86:*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*

Configuration 5 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2003:-:sp2::::::
	cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
	cpe:2.3:o:microsoft:windows_vista:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_xp:-:sp2:::professional::x64:
	cpe:2.3:o:microsoft:windows_xp:-:sp3::::::

Configuration 6 (hide)

AND

cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
	cpe:2.3:o:microsoft:windows_vista:-:sp2:::::x64:*

History

21 Nov 2024, 01:53

Type	Values Removed	Values Added
References	~~() http://www.us-cert.gov/ncas/alerts/TA13-288A - Third Party Advisory, US Government Resource~~	() http://www.us-cert.gov/ncas/alerts/TA13-288A - Third Party Advisory, US Government Resource
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081 - Patch, Vendor Advisory~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081 - Patch, Vendor Advisory
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082 - Patch, Vendor Advisory~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082 - Patch, Vendor Advisory
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18847 - Third Party Advisory~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18847 - Third Party Advisory

Information

Published : 2013-10-09 14:53

Updated : 2025-04-11 00:51

NVD link : CVE-2013-3128

Mitre link : CVE-2013-3128

CVE.ORG link : CVE-2013-3128

JSON object : View

Products Affected

microsoft

windows_server_2003
windows_server_2008
windows_7
windows_vista
windows_server_2012
windows_8
windows_xp
.net_framework
windows_rt

CWE

NVD-CWE-noinfo

{"id": "CVE-2013-3128", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-10-09T14:53:24.543", "references": [{"url": "http://www.us-cert.gov/ncas/alerts/TA13-288A", "tags": ["Third Party Advisory", "US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18847", "tags": ["Third Party Advisory"], "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/ncas/alerts/TA13-288A", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-081", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18847", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5, allow remote attackers to execute arbitrary code via a crafted OpenType font (OTF) file, aka \"OpenType Font Parsing Vulnerability.\""}, {"lang": "es", "value": "Los drivers kernel-mode en Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, y Windows RT, y .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, y 4.5, permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un archivo de fuente OpenType (OTF), tambi\u00e9n conocido como \"Vulnerabilidad de parseo de fuentes OpenType\"."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "7FE8B00B-4F39-4755-A323-8AD71F5E3EBE"}, {"criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "06BBFA69-94E2-4BAB-AFD3-BC434B11D106"}, {"criteria": "cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "26BF8305-E14B-4497-8210-CB293213596C"}, {"criteria": "cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "4A6B82ED-8ED0-4E54-85BD-199CD3174579"}, {"criteria": "cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABC7A32C-4A4A-4533-B42E-350E728ADFEB"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D929AA2-EE0B-4AA1-805D-69BCCA11B77F"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*", "vulnerable": true, "matchCriteriaId": "9F98AE07-3995-4501-9804-FEA5A87ADFAD"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "A7371547-290D-4D0D-B98D-CA28B4D2E8B0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:itanium:*", "vulnerable": true, "matchCriteriaId": "FFFD8C6B-7A46-484C-8701-81D58AB1C2CF"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "2127D10C-B6F3-4C1D-B9AA-5D78513CC996"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "AB425562-C0A0-452E-AABE-F70522F15E1A"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*", "vulnerable": true, "matchCriteriaId": "B320A104-9037-487E-BC9A-62B4A6B49FD0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF1AD1A1-EE20-4BCE-9EE6-84B27139811C"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "6FF85ADB-8F36-424D-9F4A-BD357304CE66"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*", "vulnerable": true, "matchCriteriaId": "C6109348-BC79-4ED3-8D41-EA546A540C79"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9392D35-7BF5-48E9-879B-BBDE9A9E9AB9"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D400E856-2B2E-4CEA-8CA5-309FDF371CEA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1D929AA2-EE0B-4AA1-805D-69BCCA11B77F"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "A7371547-290D-4D0D-B98D-CA28B4D2E8B0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "2127D10C-B6F3-4C1D-B9AA-5D78513CC996"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "vulnerable": false, "matchCriteriaId": "AB425562-C0A0-452E-AABE-F70522F15E1A"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BF1AD1A1-EE20-4BCE-9EE6-84B27139811C"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "6FF85ADB-8F36-424D-9F4A-BD357304CE66"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*", "vulnerable": false, "matchCriteriaId": "C6109348-BC79-4ED3-8D41-EA546A540C79"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C9392D35-7BF5-48E9-879B-BBDE9A9E9AB9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23317443-1968-4791-9F20-AD3B308A83D1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "26BF8305-E14B-4497-8210-CB293213596C"}, {"criteria": "cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:x86:*", "vulnerable": false, "matchCriteriaId": "4A6B82ED-8ED0-4E54-85BD-199CD3174579"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EDC4407-7E92-4E60-82F0-0C87D1860D3A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "vulnerable": false, "matchCriteriaId": "06BBFA69-94E2-4BAB-AFD3-BC434B11D106"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68C3652F-6730-44B0-8200-FA51D935BBA0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1D929AA2-EE0B-4AA1-805D-69BCCA11B77F"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "A7371547-290D-4D0D-B98D-CA28B4D2E8B0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "2127D10C-B6F3-4C1D-B9AA-5D78513CC996"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "vulnerable": false, "matchCriteriaId": "AB425562-C0A0-452E-AABE-F70522F15E1A"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BF1AD1A1-EE20-4BCE-9EE6-84B27139811C"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "6FF85ADB-8F36-424D-9F4A-BD357304CE66"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*", "vulnerable": false, "matchCriteriaId": "C6109348-BC79-4ED3-8D41-EA546A540C79"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C9392D35-7BF5-48E9-879B-BBDE9A9E9AB9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61FAD9EE-FA7F-4B39-8A9B-AFFAEC8BF214"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "2127D10C-B6F3-4C1D-B9AA-5D78513CC996"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "vulnerable": false, "matchCriteriaId": "AB425562-C0A0-452E-AABE-F70522F15E1A"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BF1AD1A1-EE20-4BCE-9EE6-84B27139811C"}, {"criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "6FF85ADB-8F36-424D-9F4A-BD357304CE66"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secure@microsoft.com"}

9.3 /10