Microsoft Update Tuesday: December 2013, some 0-day fixes

Summary: Microsoft's December 2013 update shipped 11 bulletins covering 24 CVE issues, including a critical IE bulletin (MS13-097) with 7 CVEs and two privilege-escalation flaws (CVE-2013-5045, CVE-2013-5046) that let an attacker break out of the low-integrity sandbox. The critical GDI+ bulletin MS13-096 fixes the 0-day CVE-2013-3906, exploited in the wild via a malicious TIFF embedded in a Word file that triggers an integer overflow, while MS13-101 does not address the separately exploited 0-day CVE-2013-5065, which is slated for a future update.
Bottom line: One actively exploited 0-day (CVE-2013-3906) gets fixed here, but CVE-2013-5065 is being exploited in the wild alongside the patched Adobe Reader flaw CVE-2013-3346 and stays open until a later update - so this month's patch cycle leaves a known live hole.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2013-3346 CVE-2013-3878 CVE-2013-3900 CVE-2013-3906 CVE-2013-5045 CVE-2013-5046 CVE-2013-5056 CVE-2013-5059 CVE-2013-5065 CVE-2013-5763 CVE-2013-5791
Related: Microsoft Update Tuesday: January 2014, fix for the XP/2003 0-day vulnerability Cyber Risks ·
CVE-2013-3346: Adobe Reader and Acrobat Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
CVE-2013-5065: Microsoft Windows Kernel Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022