Vulnerability Name:

CVE-2013-3129 (CCN-85231)

Assigned:2013-07-09
Published:2013-07-09
Updated:2020-09-28
Summary:Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability."
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2013-3129

Source: CCN
Type: SA54025
Microsoft .Net Framework / Silverlight Multiple Vulnerabilities

Source: CCN
Type: SA54057
Microsoft Products GDI+ TrueType Font Parsing Vulnerability

Source: CCN
Type: Microsoft Security Bulletin MS13-052
Vulnerabilities in .NET Framework and Silverlight Could Allow Remote Code Execution (2861561)

Source: CCN
Type: Microsoft Security Bulletin MS13-053
Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2850851)

Source: CCN
Type: Microsoft Security Bulletin MS13-054
Vulnerability in Windows Components Could Allow Remote Code Execution (2848295)

Source: CCN
Type: Microsoft Security Bulletin MS13-076
Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege (2880407)

Source: CCN
Type: Microsoft Security Bulletin MS13-081
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2870008)

Source: CCN
Type: Microsoft Security Bulletin MS13-082
Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2878890)

Source: CCN
Type: Microsoft Security Bulletin MS13-087
Vulnerability in Silverlight Could Allow Information Disclosure (2890788)

Source: CCN
Type: Microsoft Security Bulletin MS14-009
Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607)

Source: CCN
Type: Microsoft Security Bulletin MS14-014
Vulnerability in Silverlight Could Allow Security Feature Bypass (2932677)

Source: CCN
Type: Microsoft Security Bulletin MS14-038
Vulnerability in Windows Journal Could Allow Remote Code Execution (2975689)

Source: CCN
Type: Microsoft Security Bulletin MS15-080
Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (3078662)

Source: CCN
Type: Microsoft Security Bulletin MS15-097
Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (3089656)

Source: CCN
Type: Microsoft Security Bulletin MS15-115
Security Update for Microsoft Windows to Address Remote Code Execution (3105864)

Source: CCN
Type: Microsoft Security Bulletin MS15-116
Security Updates for Microsoft Office to Address Remote Code Execution (3104540)

Source: CCN
Type: Microsoft Security Bulletin MS15-118
Security Updates for .NET Framework to Address Elevation of Privilege (3104507)

Source: CCN
Type: Microsoft Security Bulletin MS15-123
Security Update for Skype for Business and Lync to Address Information Disclosure (3105872)

Source: CCN
Type: Microsoft Security Bulletin MS15-128
Security Update for Microsoft Graphics Component to Address Remote Code Execution (3104503)

Source: CCN
Type: Microsoft Security Bulletin MS15-129
Security Update for Silverlight to Address Remote Code Execution (3106614)

Source: CCN
Type: Microsoft Security Bulletin MS15-131
Security Update for Microsoft Office to Address Remote Code Execution (3116111)

Source: CCN
Type: Microsoft Security Bulletin MS15-132
Security Update for Microsoft Windows to Address Remote Code Execution (3116162)

Source: CCN
Type: Microsoft Security Bulletin MS15-135
Security Update for Windows Kernel Mode Drivers to Address Elevation of Privilege (3119075)

Source: CCN
Type: Microsoft Security Bulletin MS16-004
Security Update for Microsoft Office to Address Remote Code Execution - Critical (3124585)

Source: CCN
Type: Microsoft Security Bulletin MS16-006
Security Update for Silverlight to Address Remote Code Execution (3126036)

Source: CCN
Type: Microsoft Security Bulletin MS16-008
Security Update for Kernel to Address Elevation of Privilege (3124605)

Source: CCN
Type: Microsoft Security Bulletin MS16-014
Security update for Microsoft Windows to Address Remote Code Execution (3134228)

Source: CCN
Type: Microsoft Security Bulletin MS16-015
Security Update for Microsoft Office to Address Remote Code Execution (3134226)

Source: CCN
Type: Microsoft Security Bulletin MS16-029
Security Update for Microsoft Office to Address Remote Code Execution (3141806)

Source: CCN
Type: Microsoft Security Bulletin MS16-031
Security Update for Microsoft Windows to Address Elevation of Privilege (3140410)

Source: CCN
Type: Microsoft Security Bulletin MS16-035
Security Update for .NET Framework to Address Security Feature Bypass (3141780)

Source: CCN
Type: Microsoft Security Bulletin MS16-042
Security Update for Microsoft Office (3148775)

Source: CCN
Type: Microsoft Security Bulletin MS16-044
Security Update for Windows OLE (3146706)

Source: CCN
Type: Microsoft Security Bulletin MS16-048
Security Update for CSRSS (3148528)

Source: CCN
Type: Microsoft Security Bulletin MS16-054
Security Update for Microsoft Office (3155544)

Source: CCN
Type: Microsoft Security Bulletin MS16-060
Security Update for Windows Kernel (3154846)

Source: CCN
Type: Microsoft Security Bulletin MS16-061
Security Update for Microsoft RPC (3155520)

Source: CCN
Type: Microsoft Security Bulletin MS16-070
Security Update for Office (3163610)

Source: CCN
Type: Microsoft Security Bulletin MS16-088
Security Updates for Office (3170008)

Source: CCN
Type: Microsoft Security Bulletin MS16-092
Security Update for Windows Kernel (3171910)

Source: CCN
Type: Microsoft Security Bulletin MS16-097
Security Update for Microsoft Graphics Component (3177393)

Source: CCN
Type: Microsoft Security Bulletin MS16-099
Security Update for Office (3177451)

Source: CCN
Type: Microsoft Security Bulletin MS16-106
Security Update for Microsoft Graphics Component (3185848)

Source: CCN
Type: Microsoft Security Bulletin MS16-107
Security Update for Microsoft Office (3185852)

Source: CCN
Type: Microsoft Security Bulletin MS16-109
Security Update for Silverlight (3182373)

Source: CCN
Type: Microsoft Security Bulletin MS16-111
Security Update for Windows Kernel (3186973)

Source: CCN
Type: Microsoft Security Bulletin MS16-120
Security Update for Microsoft Graphics Component (3192884)

Source: CCN
Type: Microsoft Security Bulletin MS16-121
Security Update for Microsoft Office (3194063)

Source: CCN
Type: Microsoft Security Bulletin MS16-122
Security Update for Microsoft Video Control (3195360)

Source: CCN
Type: Microsoft Security Bulletin MS16-123
Security Update for Kernel-Mode Drivers (3192892)

Source: CCN
Type: Microsoft Security Bulletin MS16-124
Security Update for Windows Registry (3193227)

Source: CCN
Type: Microsoft Security Bulletin MS16-126
Security Update for Microsoft Internet Messaging API (3196067)

Source: CCN
Type: Microsoft Security Bulletin MS16-131
Security Update for Microsoft Video Control (3199151)

Source: CCN
Type: Microsoft Security Bulletin MS16-133
Security Update for Microsoft Office (3199168)

Source: CCN
Type: Microsoft Security Bulletin MS16-139
Security Update for Windows Kernel (3199720)

Source: CCN
Type: Microsoft Security Bulletin MS16-148
Security Update for Microsoft Office (3204068)

Source: CCN
Type: Microsoft Security Bulletin MS16-155
Security Update for .NET Framework (3205640)

Source: CCN
Type: Microsoft Security Bulletin MS17-002
Security Update for Microsoft Office (3214291)

Source: CCN
Type: Microsoft Security Bulletin MS17-006
Cumulative Security Update for Internet Explorer (4013073)

Source: CCN
Type: Microsoft Security Bulletin MS17-013
Security Update for Microsoft Graphics Component (4013075)

Source: CCN
Type: Microsoft Security Bulletin MS17-014
Security Update for Microsoft Office (4013241)

Source: CCN
Type: BID-60978
Microsoft Windows TrueType Font CVE-2013-3129 Remote Code Execution Vulnerability

Source: CERT
Type: Third Party Advisory, US Government Resource
TA13-190A

Source: MS
Type: UNKNOWN
MS13-052

Source: MS
Type: UNKNOWN
MS13-053

Source: MS
Type: UNKNOWN
MS13-054

Source: XF
Type: UNKNOWN
ms-win-cve20133129-code-exec(85231)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:17323

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:17341

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2010:*:attendee:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2010:*:x64:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2010:*:x86:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2013:-:x64:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2013:-:x86:*:*:*:*:*
  • OR cpe:/a:microsoft:lync_basic:2013:-:x64:*:*:*:*:*
  • OR cpe:/a:microsoft:lync_basic:2013:-:x86:*:*:*:*:*
  • OR cpe:/a:microsoft:office:2003:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:office:2007:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:office:2010:sp1:x64:*:*:*:*:*
  • OR cpe:/a:microsoft:office:2010:sp1:x86:*:*:*:*:*
  • OR cpe:/a:microsoft:silverlight:5.0.60401.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:silverlight:5.0.60818.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:silverlight:5.0.60818.0:rc:*:*:*:*:*:*
  • OR cpe:/a:microsoft:silverlight:5.0.61118.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:silverlight:5.1.10411.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:silverlight:5.1.20125.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_8:-:*:*:*:pro_n:*:x64:*
  • OR cpe:/o:microsoft:windows_8:-:*:*:*:pro_n:*:x86:*
  • OR cpe:/o:microsoft:windows_rt:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*
  • OR cpe:/a:microsoft:office:2003:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_7:-:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*
  • OR cpe:/a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:-:sp1:*:*:ultimate_n:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
  • OR cpe:/a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:office:2010:sp1:x32:*:*:*:*:*
  • OR cpe:/a:microsoft:office:2010:sp1:x64:*:*:*:*:*
  • OR cpe:/a:microsoft:office:2007:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:silverlight:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2010:*:attendee:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2010:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_8:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:lync:2013:-:x64:*:*:*:*:*
  • OR cpe:/a:microsoft:lync_basic:2013:-:x64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:17341
    V
    		TrueType Font Parsing Vulnerability - CVE-2013-3129 (MS13-052, MS13-053, MS13-054)
    2015-02-23
    oval:org.mitre.oval:def:17323
    V
    		TrueType font parsing vulnerability in Microsoft Silverlight - CVE-2013-3129, MS13-052 (Mac OS)
    2013-08-26
    BACK
    microsoft .net framework 3.0 sp2
    microsoft .net framework 3.5
    microsoft .net framework 3.5.1
    microsoft .net framework 4.0
    microsoft .net framework 4.5
    microsoft lync 2010
    microsoft lync 2010
    microsoft lync 2010
    microsoft lync 2013 -
    microsoft lync 2013 -
    microsoft lync basic 2013 -
    microsoft lync basic 2013 -
    microsoft office 2003 sp3
    microsoft office 2007 sp3
    microsoft office 2010 sp1
    microsoft office 2010 sp1
    microsoft silverlight 5.0.60401.0
    microsoft silverlight 5.0.60818.0
    microsoft silverlight 5.0.60818.0 rc
    microsoft silverlight 5.0.61118.0
    microsoft silverlight 5.1.10411.0
    microsoft silverlight 5.1.20125.0
    microsoft visual studio .net 2003 sp1
    microsoft windows 7 * sp1
    microsoft windows 7 * sp1
    microsoft windows 8 - -
    microsoft windows 8 - -
    microsoft windows rt -
    microsoft windows server 2003 * sp2
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 * sp2
    microsoft windows server 2012 -
    microsoft windows vista * sp2
    microsoft windows vista * sp2
    microsoft windows xp * sp3
    microsoft windows xp - sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows xp sp2
    microsoft office 2003 sp3
    microsoft visual studio .net 2003 sp1
    microsoft windows server 2008 -
    microsoft windows xp sp3
    microsoft windows vista - sp2
    microsoft windows vista - sp2
    microsoft windows server 2008 sp2
    microsoft windows server 2008 sp2
    microsoft windows 7 -
    microsoft windows server 2008 - r2
    microsoft windows server 2008 r2
    microsoft windows server 2008
    microsoft .net framework 4.0
    microsoft windows 7 - sp1
    microsoft windows server 2008 r2 sp1
    microsoft windows server 2008 r2 sp1
    microsoft .net framework 3.0 sp2
    microsoft office 2010 sp1
    microsoft office 2010 sp1
    microsoft office 2007 sp3
    microsoft silverlight 5.0
    microsoft lync 2010
    microsoft .net framework 4.5
    microsoft lync 2010
    microsoft windows server 2012
    microsoft windows 8 *
    microsoft lync 2013 -
    microsoft lync basic 2013 -