⚠ Actively exploited
Added to CISA KEV on 2022-02-15. Federal agencies required to patch by 2022-08-15. Required action: Apply updates per vendor instructions..

CVE-2013-3906

CWE-94Code Injection10 documents9 sources
Severity
7.8HIGH
EPSS
92.6%
top 0.26%
CISA KEV
KEV
Added 2022-02-15
Due 2022-08-15
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedNov 6
KEV addedFeb 15
Latest updateMay 14
KEV dueAug 15
CISA Required Action: Apply updates per vendor instructions.

Description

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

NVDmicrosoft/office2003, 2007, 2010+2
NVDmicrosoft/lync2010, 2013+1

Patches

🔴Vulnerability Details

3
GHSA
GHSA-7mhx-7529-p5jc: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 20102022-05-14
CVEList
CVE-2013-3906: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 20102013-11-06
VulnCheck
Microsoft Graphics Component Memory Corruption Vulnerability2013

💥Exploits & PoCs

1
Exploit-DB
Microsoft - Tagged Image File Format '.TIFF' Integer Overflow (Metasploit)2013-12-03

🔍Detection Rules

1
Suricata
ET MALWARE W32/Citadel.Arx Variant CnC Beacon 12013-11-07

📋Vendor Advisories

1
CISA
Microsoft Graphics Component Memory Corruption Vulnerability2022-02-15

🕵️Threat Intelligence

1
Talos
Microsoft Update Tuesday: December 2013, some 0-day fixes2013-12-10