CVE-2013-1302
Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 21.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 21.91% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- microsoft/lync · microsoft/lync server · microsoft/office communicator
- Source
- secure@microsoft.com
References
- http://www.us-cert.gov/ncas/alerts/TA13-134AThird Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952
- http://www.us-cert.gov/ncas/alerts/TA13-134AThird Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.