CVE-2013-5057

Published: Dec 11, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

hxds.dll in Microsoft Office 2007 SP3 and 2010 SP1 and SP2 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code via a crafted COM component on a web site that is visited with Internet Explorer, as exploited in the wild in December 2013, aka "HXDS ASLR Vulnerability."

Affected (5)

Products: Microsoft: Office

Microsoft

1 product

Office

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2007 sp3
Microsoft Office	Version 2010 sp1
Microsoft Office	Version 2010 sp1
Microsoft Office	Version 2010 sp2
Microsoft Office	Version 2010 sp2

Related CWEs

CWE-264

References (4)

http://blogs.technet.com/b/srd/archive/2013/12/09/ms13-106-another-aslr-bypass-is-gone.aspx

Source: secure@microsoft.com

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-106

Source: secure@microsoft.com

http://blogs.technet.com/b/srd/archive/2013/12/09/ms13-106-another-aslr-bypass-is-gone.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-106

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.