VulnerabilityModified
CVE-2013-3870
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
HIGH 9.3EPSS 18.6%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 18.6%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 18.64% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- microsoft/outlook
- Source
- secure@microsoft.com
References
- http://blogs.technet.com/b/srd/archive/2013/09/10/assessing-risk-for-the-september-2013-security-updates.aspxVendor Advisory
- http://blogs.technet.com/b/srd/archive/2013/09/10/ms13-068-a-difficult-to-exploit-double-free-in-outlook.aspxExploit, Vendor Advisory
- http://www.us-cert.gov/ncas/alerts/TA13-253AUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-068
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18857
- http://blogs.technet.com/b/srd/archive/2013/09/10/assessing-risk-for-the-september-2013-security-updates.aspxVendor Advisory
- http://blogs.technet.com/b/srd/archive/2013/09/10/ms13-068-a-difficult-to-exploit-double-free-in-outlook.aspxExploit, Vendor Advisory
- http://www.us-cert.gov/ncas/alerts/TA13-253AUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-068
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18857
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.