Microsoft Update Tuesday August 2013: More font issues, some interesting DoSes

Summary: Microsoft's August 2013 Update Tuesday shipped 8 bulletins covering 23 CVEs, including an IE bulletin (MS13-059) spanning 11 CVEs across IE6-IE10 and the final two issues reported at CanSecWest's Pwn2Own. The batch also included a Unicode font flaw (MS13-060) limited to XP SP3, XP Professional 64-bit and Server 2003, kernel fixes in MS13-063 that close the Pwn2Own issue VUPEN used to bypass ASLR (CVE-2013-2556), and two ICMP denial-of-service bugs (MS13-064, MS13-065) that crash a system and force a reboot.
Key Takeaway: One of the fixed kernel issues is the Pwn2Own bypass VUPEN used to defeat ASLR, and the two ICMP flaws let a single crafted packet crash a server and force a reboot - so patch priority should follow exploitability, not bulletin count.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2012-3776 CVE-2013-2393 CVE-2013-2556 CVE-2013-3175 CVE-2013-3181 CVE-2013-3182 CVE-2013-3183 CVE-2013-3185 CVE-2013-3196 CVE-2013-3197 CVE-2013-3198
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026