Microsoft Update Tuesday November 2013: HyperV vulnerability and fix for 0day

Summary: Microsoft's November 2013 Update Tuesday shipped 8 bulletins covering 19 CVEs, 3 of them critical, including a fix for a 0-day ActiveX vulnerability (CVE-2013-3918) in the InformationCardSigninHelper control that was seeing limited exploitation in the wild. The most notable non-critical item was a Hyper-V flaw (CVE-2013-3898) that lets an attacker run code from one virtual machine in the context of another, with a failed attack causing a denial of service.
What you should know: A hypervisor bug that crosses VM boundaries undermines the assumption that one compromised guest stays contained, and the ActiveX 0-day was already being exploited before the patch arrived.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2013-3869 CVE-2013-3887 CVE-2013-3898 CVE-2013-3905 CVE-2013-3918 CVE-2013-3940
Related: CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Oct 06, 2025
Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026