KEV 2013

Microsoft Windows - InformationCardSigninHelper ActiveX Out-of-Bounds Write Used in Operation GreedyWonk Water-Hole Attacks

Microsoft Internet Explorer - SetMouseCapture Use-After-Free Zero-Day Exploited in Operation DeputyDog Against Japanese Organizations

Adobe Flash Player - Incorrect Firefox Sandbox Permissions Enable Flash-Based Sandbox Escape in Paired Attack with CVE-2013-0648

Adobe Flash Player - ExternalInterface ActionScript Code Execution Chained With CVE-2013-0643 for Full Firefox Sandbox Escape

Microsoft Internet Explorer - CDisplayPointer Out-of-Bounds Write Enables Remote Code Execution via Crafted Website

Linux Kernel - ARM get_user/put_user Missing Address Validation Allows Any Process to Read and Write Kernel Memory

Linux Kernel - perf_swevent_enabled Out-of-Bounds Write via Unchecked attr.config for Local Privilege Escalation

Code Aurora ACDB - Qualcomm Audio Calibration Driver IOCTL Stack Overflow Enables Kernel Privilege Escalation on Android

Linux Kernel - fb_mmap Framebuffer Integer Overflow Maps Physical Memory to Userspace for Android and Linux Privilege Escalation

Microsoft Office - PNG Parsing Buffer Overflow in Office Documents Allows Remote Code Execution

Microsoft Silverlight - Double Pointer Dereference in HTML Rendering Enables Drive-By RCE, Exploited by Ransomware Kits

Mozilla Firefox and Thunderbird - XMLHttpRequest onreadystatechange Use-After-Free Enables Remote Code Execution

Microsoft Internet Explorer - CParentUndoUnit Use-After-Free Allows Remote Code Execution, Exploited for Ransomware Delivery

Microsoft Internet Explorer 8 - CGenericElement Use-After-Free Zero-Day Used to Water-Hole US Department of Labor Website

Microsoft Internet Explorer - CDisplayPointer Use-After-Free Zero-Day Exploited in Operation Ephemeral Hydra Water-Hole Attacks

Microsoft Win32k - EPATHOBJ Linked List Pointer Flaw Enables Any Local User to Execute Code in Ring 0

Adobe Reader and Acrobat - acroform.dll Memory Corruption Zero-Day Chained With CVE-2013-0641 to Escape Sandbox

Adobe Reader - Buffer Overflow Used as Second Stage to Escape Reader Protected Mode Sandbox in CVE-2013-0640 Chain

Microsoft Windows - NDProxy.sys Improper Input Validation Enables SYSTEM Privilege Escalation, Chained with Adobe Reader Zero-Day in APT Attacks

Adobe ColdFusion - Unauthenticated Directory Traversal Exposes Restricted Server Files Including Configuration and Credentials

Adobe ColdFusion - Unspecified Information Disclosure from Compromised ColdFusion Server Components

Microsoft Graphics Component - TIFF Image Parsing Zero-Day in GDI+ Delivers Remote Code Execution via Office Documents and Web Content