Actively exploited · Published Jul 10, 2013 · Assigned by microsoft
CVE-2013-3163
High 8.8 Exploited
In plain English
A high-severity out-of-bounds write in Internet Explorer from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 30, 2023). The chance it is exploited in the next 30 days is estimated at 70.7% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Apr 20, 2023.
Official description
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151.
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- MS13-055 vendor-advisory, x_refsource_MS
- oval:org.mitre.oval:def:17363 vdb-entry, signature, x_refsource_OVAL
- TA13-190A third-party-advisory, x_refsource_CERT
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3163 government-resource