Actively exploited · Published May 5, 2013 · Assigned by microsoft
CVE-2013-1347
High 8.8 Exploited
In plain English
A high-severity use-after-free in Internet Explorer from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 77.7% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 24, 2022.
Official description
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- 25294 exploit, x_refsource_EXPLOIT-DB
- TA13-134A third-party-advisory, x_refsource_CERT
- oval:org.mitre.oval:def:16727 vdb-entry, signature, x_refsource_OVAL
- http://technet.microsoft.com/security/advisory/2847140 x_refsource_CONFIRM
- MS13-038 vendor-advisory, x_refsource_MS
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1347 government-resource