Microsoft Patch Tuesday 2013-08-13

MS13-059
Title A multitude of new vulnerabilities have been added to the regular cumulative IE update. You want this one if you use IE.
Replaces
Affected MSIE
KB KB2862772
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-3184 1
Top of page
MS13-060
Title A vulnerability in how OpenType fonts are handled allow for random code execution with the rights of the logged-on user. Note that exploitation over the Internet via a a browser is possible.
Replaces
Affected unicode font parsing
KB KB2850869
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-3181 2
Top of page
MS13-061
Title Multiple publicly disclosed vulnerabilities allow random code execution when previewing malicious content using OWA (Outlook Web Access). The vulnerabilities are situated in the webready (to display attachments) and Data Loss Prevention (DLP) components.
Replaces
Affected Exchange
KB KB2876063
Known Exploits Yes
Microsoft Rating Critical
ISC Client Rating N/A
ISC Server Rating N/A
CVE Exploitability
2013-2393 2
Top of page
MS13-062
Title A vulnerability in the handling of asynchronous RPC requests allows for an escalation of privileges. As such it would allow execution of random code in the context of another user.
Replaces
Affected Microsoft RPC
KB KB2849470
Known Exploits No
Microsoft Rating Important
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-3175 1
Top of page
MS13-063
Title Multiple vulnerabilities allow privilege escalation. Of note is CVE-2013-2556, which allows to bypass a security feature called ASLR (Address Space Layout Randomization)
Replaces
Affected Windows Kernel
KB KB2859537
Known Exploits Yes
Microsoft Rating Important
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-2556 1
Top of page
MS13-064
Title A memory corruption vulnerability in the Windows NAT driver allows for a denial of service (DoS) situation that would cause the system to stop responding till restated. Relies on malicious ICMP packets. Unrelated to MS13-065.
Replaces
Affected NAT driver
KB KB2849568
Known Exploits No
Microsoft Rating Important
ISC Client Rating Less urgent
ISC Server Rating Less urgent
CVE Exploitability
2013-3182 3
Top of page
MS13-065
Title A memory allocation problem in the ICMPv6 implementation allows attackers to cause a Denial of Service (DoS). Exploitation would cause the system to stop responding till restarted. Unrelated to MS13-064.
Replaces
Affected ICMPv6
KB KB2868623
Known Exploits No
Microsoft Rating Important
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-3183 3
Top of page
MS13-066
Title Active Directory Federation Services (AD FS) could reveal information about the service account used. This information could as an example subsequently be used in a Denial of Service attack by locking the account out, causing all users that rely on the fe
Replaces
Affected Active Directory
KB KB2873872
Known Exploits No
Microsoft Rating Important
ISC Client Rating N/A
ISC Server Rating N/A
CVE Exploitability
2013-3185 3
Top of page
We will update issues on this page for about a week or so as they evolve. We appreciate your updates!
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.