« Volver al listado

CVE-2013-3870

Estado: ModificadaAlta (9.3)—

Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Outlook

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-3870",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-09-11T14:03:48.677",
  "references": [
    {
      "url": "http://blogs.technet.com/b/srd/archive/2013/09/10/assessing-risk-for-the-september-2013-security-updates.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://blogs.technet.com/b/srd/archive/2013/09/10/ms13-068-a-difficult-to-exploit-double-free-in-outlook.aspx",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-253A",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-068",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18857",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://blogs.technet.com/b/srd/archive/2013/09/10/assessing-risk-for-the-september-2013-security-updates.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://blogs.technet.com/b/srd/archive/2013/09/10/ms13-068-a-difficult-to-exploit-double-free-in-outlook.aspx",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-253A",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-068",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18857",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka \"Message Certificate Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de doble liberación en Microsoft Outlook 2007 (SP3) y 2010 (SP1 y SP2) permite a atacantes remotos ejecutar código a discrección incluyendo varios certificados S/MIME anidados en un mensaje de correo electrónico, tambien conocido como \"Vulnerabilidad de Certificado de Mensaje\"."
    }
  ],
  "lastModified": "2026-06-16T23:55:56.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2007:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B32CD31-398A-4078-8B5B-B39DB9DB9A35"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2010:sp1:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "92BC9C1B-12DB-490E-BFFD-EAED658B8613"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2010:sp1:*:*:*:x86:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99B1C3FD-27CF-43CD-9F25-1A1ED29E4DA0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "61826B69-4D5C-46DD-9F55-21A7C09A2819"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:x86:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D8C49EA-7FF2-4393-A05A-ED3AD4796CD5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}