Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted Silverlight application, aka "Null Pointer Vulnerability."

The version of the .NET Framework installed on the remote host is reportedly affected by the following vulnerabilities :

  - A vulnerability exists in the way that affected     components handle specially crafted TrueType font     files that could lead to remote code execution.  An     attacker could leverage this issue by enticing a user     to open a specially crafted TrueType font file.
    (CVE-2013-3129)

  - The .NET Framework does not properly handle     multidimensional arrays of small structures, which     could lead to remote code execution. (CVE-2013-3131)

  - The .NET Framework does not properly validate the     permissions of certain objects performing reflection.
    This could allow an attacker to elevate their privileges     and take complete control of the system.
    (CVE-2013-3132)

  - The .NET Framework does not properly validate the     permissions of objects involved with reflection, which     could lead to an elevation of privileges.
    (CVE-2013-3133)

  - The .NET Framework is affected by a remote code     execution vulnerability due to the way in which it     allocates arrays of small structures. (CVE-2013-3134)

  - The .NET Framework does not properly validate the     permissions for delegate objects during serialization,     which could lead to an elevation of privileges.
    (CVE-2013-3171)

  - Microsoft Silverlight does not properly handle null     pointers, which could lead to remote code execution.
    (CVE-2013-3178)

An attacker may be able to leverage these vulnerabilities to execute arbitrary code on the affected system if a user can be tricked into viewing a specially crafted web page using a web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications.

The version of Microsoft Silverlight installed on the remote host reportedly handles a dereference to a NULL pointer incorrectly.

If an attacker could trick a user on the affected system into visiting a website hosting a malicious Silverlight application, the attacker could leverage this vulnerability to execute arbitrary code on the affected system, subject to the user's privileges.

ID	Name	Product	Family	Severity
67209	MS13-052: Vulnerabilities in .NET Framework and Silverlight Could Allow Remote Code Execution (2861561)	Nessus	Windows : Microsoft Bulletins	high
67208	MS13-052: Vulnerability in Silverlight Could Allow Remote Code Execution (2861561) (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2013-3178

high

Tenable Plugins

high

high