Today we released seven security bulletins addressing 34 CVE’s. Six bulletins have a maximum severity rating of Critical, and one has a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment.
| Bulletin | Most likely attack vector | Max Bulletin Severity | Max Exploit-ability rating | Likely first 30 days impact | Platform mitigations and key notes |
|---|---|---|---|---|---|
| MS13-055(Internet Explorer) | Victim browses to a malicious webpage. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | 17 CVE’s being addressed. |
| MS13-053(win32k.sys and TTF font parsing) | Most likely to be exploited attack vector requires attacker to already be running code on a machine and then uses this vulnerability to elevate from low-privileged account to SYSTEM.Additional attack vector involves victim browsing to a malicious webpage that serves up TTF font file resulting in code execution as SYSTEM. | Critical | 1 | Public proof-of-concept exploit code currently exists for CVE-2013-3660. | Public EPATHOBJ issue (CVE-2013-3660) addressed by this update.Kernel-mode portion of TTF font parsing issue (CVE-2013-3129) addressed by this update. |
| MS13-052(.NET Framework and Silverlight) | Victim browses to a malicious Silverlight application hosted on a website. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | .NET Framework and Silverlight exposure to TTF font parsing issue (CVE-2013-3129) addressed by this update. |
| MS13-054(GDI+) | Victim opens a malicious TTF file using an application that leverages GDI+ for font parsing. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | User-mode (gdiplus.dll) exposure to TTF font parsing issue (CVE-2013-3129) addressed by this update. |
| MS13-056(DirectShow) | Victim opens malicious .GIF file using a 3rd-party application that leverages the DirectShow library. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | No Microsoft end-user applications are known to be vulnerable to the single CVE being addressed by this update. |
| MS13-057(Windows Media) | Victim browses to a malicious webpage or opens a malicious Windows Media file. | Critical | 2 | Difficult to build a reliable exploit for this issue. Less likely to see an exploit developed within next 30 days. | One CVE being addressed. |
| MS13-058(Windows Defender) | Attacker having write access to the root of the system drive (C:\) places malicious file that is run as LocalSystem by Windows Defender during its signature update process. | Important | 1 | Likely to see reliable exploits developed within next 30 days.Unlikely to see wide-spread infection as low privileged users do not have permission to write to root of system drive by default. | To exploit the vulnerability addressed by this update, attacker must have permission to create a new file at the root of the system drive. (C:\malicious.exe) |
- Jonathan Ness, MSRC Engineering