Patch Tuesday, October 2013
Microsoft's monthly security release, Tuesday, October 8, 2013. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
- 8.8HighOct 9, 2013Microsoft Internet Explorer Memory corruptionCVE-2013-3897A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.Exploited77% likelyExploit codeExploit-DB · Metasploit
- 5.5MediumOct 9, 2013Microsoft Silverlight Information disclosureCVE-2013-3896Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.Exploited68% likelyExploit codeExploit-DB · Metasploit
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.