Microsoft Update Tuesday October 2013: Another IE 0-day release

Summary: Microsoft's October 2013 Update Tuesday shipped 8 bulletins covering 26 CVEs, four of them rated critical. The lead bulletin, MS13-080, is a cumulative IE update fixing 10 CVE issues, two of which were already exploited in the wild: CVE-2013-3893, widely reported and exploited, and CVE-2013-3897, exploited in a more targeted manner.
What's compelling: Two of the IE flaws being patched had already been used by attackers, and MS13-081's CVE-2013-3200 lets an attacker gain system-level code execution simply by inserting a USB key into a machine.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2013-3128 CVE-2013-3195 CVE-2013-3200 CVE-2013-3889 CVE-2013-3890 CVE-2013-3891 CVE-2013-3893 CVE-2013-3895 CVE-2013-3896 CVE-2013-3897
Related: Adobe, Microsoft Push Critical Security Fixes Cyber Risks ·
CVE-2013-3893: Microsoft Internet Explorer Resource Management Errors Vulnerability Known Exploited Vulnerabilities · Aug 12, 2025
CVE-2013-3896: Microsoft Silverlight Information Disclosure Vulnerability Known Exploited Vulnerabilities · May 25, 2022