Unscored severity · published May 15, 2013
CVE-2013-1302
Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary…
–
CVSS
21.9%
EPSS
No
On KEV
Description
Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)21.9% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LY
Lync · Microsoft
2010; 2010; 2010 · source: NVD
LS
Lync Server · Microsoft
2013 · source: NVD
OC
Office Communicator · Microsoft
2007 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1302
Third Party Advisory
http://www.us-cert.gov/ncas/alerts/TA13-134A
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15952
More from Lync
7.8
CVE-2015-1671
Microsoft Windows Remote Code Execution Vulnerability
7.8
CVE-2013-3906
Microsoft Graphics Component Memory Corruption Vulnerability
9.8
CVE-2020-1025
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation
9.8
CVE-2016-7182
The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10…
8.8
CVE-2018-8311
A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remote Code Execution…