# CVEs published 2013-12-11

37 CVEs were published on December 11, 2013: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-5331](https://cve.now/CVE-2013-5331.md): Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, A (no CVSS)
- [CVE-2013-5332](https://cve.now/CVE-2013-5332.md): Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, A (no CVSS)
- [CVE-2013-5333](https://cve.now/CVE-2013-5333.md): Adobe Shockwave Player before 12.0.7.148 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS)
- [CVE-2013-5334](https://cve.now/CVE-2013-5334.md): Adobe Shockwave Player before 12.0.7.148 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns (no CVSS)
- [CVE-2013-5609](https://cve.now/CVE-2013-5609.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before (no CVSS)
- [CVE-2013-5610](https://cve.now/CVE-2013-5610.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 allow remote attackers t (no CVSS)
- [CVE-2013-5611](https://cve.now/CVE-2013-5611.md): Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to (no CVSS)
- [CVE-2013-5612](https://cve.now/CVE-2013-5612.md): Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 makes it easier for remote attackers to in (no CVSS)
- [CVE-2013-5613](https://cve.now/CVE-2013-5613.md): Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, (no CVSS)
- [CVE-2013-5614](https://cve.now/CVE-2013-5614.md): Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing (no CVSS)
- [CVE-2013-5615](https://cve.now/CVE-2013-5615.md): The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2. (no CVSS)
- [CVE-2013-5616](https://cve.now/CVE-2013-5616.md): Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x bef (no CVSS)
- [CVE-2013-5618](https://cve.now/CVE-2013-5618.md): Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla (no CVSS)
- [CVE-2013-5619](https://cve.now/CVE-2013-5619.md): Multiple integer overflows in the binary-search implementation in SpiderMonkey in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 migh (no CVSS)
- [CVE-2013-6671](https://cve.now/CVE-2013-6671.md): The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonk (no CVSS)
- [CVE-2013-6672](https://cve.now/CVE-2013-6672.md): Mozilla Firefox before 26.0 and SeaMonkey before 2.23 on Linux allow user-assisted remote attackers to read clipboard data by leveraging cer (no CVSS)
- [CVE-2013-6673](https://cve.now/CVE-2013-6673.md): Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user's remo (no CVSS)
- [CVE-2013-3878](https://cve.now/CVE-2013-3878.md): Stack-based buffer overflow in the LRPC client in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges (no CVSS)
- [CVE-2013-3899](https://cve.now/CVE-2013-3899.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate addresses, which al (no CVSS)
- [CVE-2013-3900](https://cve.now/CVE-2013-3900.md): WinVerifyTrust Signature Validation Vulnerability (CVSS 5.5, KEV, Microsoft Windows)
- [CVE-2013-3902](https://cve.now/CVE-2013-3902.md): Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1 and Windows 7 SP1 on 64-bit pl (no CVSS)
- [CVE-2013-3903](https://cve.now/CVE-2013-3903.md): Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012 Gold and R2, and Windows RT Gold and (no CVSS)
- [CVE-2013-3907](https://cve.now/CVE-2013-3907.md): portcls.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows (no CVSS)
- [CVE-2013-5042](https://cve.now/CVE-2013-5042.md): Cross-site scripting (XSS) vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foun (no CVSS)
- [CVE-2013-5045](https://cve.now/CVE-2013-5045.md): Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges (no CVSS)
- [CVE-2013-5046](https://cve.now/CVE-2013-5046.md): Microsoft Internet Explorer 7 through 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privile (no CVSS)
- [CVE-2013-5047](https://cve.now/CVE-2013-5047.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-5048](https://cve.now/CVE-2013-5048.md): Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2013-5049](https://cve.now/CVE-2013-5049.md): Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v (no CVSS)
- [CVE-2013-5051](https://cve.now/CVE-2013-5051.md): Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2013-5052](https://cve.now/CVE-2013-5052.md): Microsoft Internet Explorer 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS)
- [CVE-2013-5054](https://cve.now/CVE-2013-5054.md): Microsoft Office 2013 and 2013 RT allows remote attackers to discover authentication tokens via a crafted response to a file-open request fo (no CVSS)
- [CVE-2013-5056](https://cve.now/CVE-2013-5056.md): Use-after-free vulnerability in the Scripting Runtime Object Library in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V (no CVSS)
- [CVE-2013-5057](https://cve.now/CVE-2013-5057.md): hxds.dll in Microsoft Office 2007 SP3 and 2010 SP1 and SP2 does not implement the ASLR protection mechanism, which makes it easier for remot (no CVSS)
- [CVE-2013-5058](https://cve.now/CVE-2013-5058.md): Integer overflow in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server (no CVSS)
- [CVE-2013-5059](https://cve.now/CVE-2013-5059.md): Microsoft SharePoint Server 2010 SP1 and SP2 and 2013, and Office Web Apps 2013, allows remote attackers to execute arbitrary code via craft (no CVSS)
- [CVE-2013-5072](https://cve.now/CVE-2013-5072.md): Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 an (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.