CVE-2013-1302

Critical

Description

Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."

SeverityCritical

CVSS9.3

Exploit probability—

Product

Microsoft Lync

PublishedMay 15, 2013

First seenMay 15, 2013

How to fix

Vendor advisories

docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-041

Affected products

Product	Affected versions	Fixed in
microsoft lync	2010	—
microsoft lync_server	2013	—
microsoft office_communicator	2007	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.