Actively exploited in the wild
Microsoft Silverlight Information Disclosure Vulnerability
Microsoft - Silverlight · Listed in the CISA KEV since 2022-05-25. This indicates confirmed attacks in production environments.
Required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2013-3896
MediumCVSS 5.5KEVSummary
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
Risk Assessment
An attacker can access sensitive information from process memory, potentially leading to data leakage. This may breach the confidentiality of information processed by the application.
Recommendation
Update Microsoft Silverlight to version 5.1.20913.0 or later. It is also recommended to consider restricting or disabling Silverlight if not required.
Other vulnerabilities in Microsoft Silverlight
See all- CVE-2016-3367High
Microsoft Silverlight 5 before version 5.1.50709.0 has a memory allocation issue in string-insert and string-append operations, which can lead to memory corruption.
- CVE-2015-6166High
Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service via unspecified open and close requests, known as 'Microsoft Silverlight RCE Vulnerability.'
- CVE-2015-1715High
Microsoft Silverlight 5 before 5.1.40416.00 allows remote attackers to bypass intended integrity-level restrictions via a crafted Silverlight application.
- CVE-2014-0319High
Microsoft Silverlight 5 before 5.1.30214.0 and Silverlight 5 Developer Runtime before 5.1.30214.0 allow attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Original NVD description (English source)
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."