Microsoft Silverlight vulnerabilities

32 CVEs affecting Microsoft Silverlight, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-8527, published 2017-06-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-0074: Microsoft Silverlight Double Dereference Vulnerability, published 2013-03-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 78.9% chance of exploitation in the next 30 days. Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a…
CVE-2016-0034: Microsoft Silverlight Runtime Remote Code Execution Vulnerability, published 2016-01-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 69.4% chance of exploitation in the next 30 days. Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption)…
CVE-2013-3896: Microsoft Silverlight Information Disclosure Vulnerability, published 2013-10-09. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 68% chance of exploitation in the next 30 days. Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted…
CVE-2015-1671: Microsoft Windows Remote Code Execution Vulnerability, published 2015-05-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 49% chance of exploitation in the next 30 days. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010…
CVE-2016-3209, published 2016-10-14. Medium severity, CVSS 5.5. EPSS: 53.7% chance of exploitation in the next 30 days. Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10…
CVE-2017-0108, published 2017-03-17. High severity, CVSS 7.8. EPSS: 50.5% chance of exploitation in the next 30 days. The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows…
CVE-2017-0283, published 2017-06-15. High severity, CVSS 8.8. EPSS: 39% chance of exploitation in the next 30 days. Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007…
CVE-2015-2455, published 2015-08-15. High severity, CVSS 9.3. EPSS: 37.4% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010…
CVE-2015-2464, published 2015-08-15. High severity, CVSS 9.3. EPSS: 35.6% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live…
CVE-2015-2456, published 2015-08-15. High severity, CVSS 9.3. EPSS: 35.6% chance of exploitation in the next 30 days. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010…

Latest

CVE-2017-8527, published 2017-06-15. High severity, CVSS 8.8. EPSS: 19% chance of exploitation in the next 30 days. Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote…
CVE-2016-3367, published 2016-09-14. High severity, CVSS 8.8. EPSS: 17.8% chance of exploitation in the next 30 days. StringBuilder in Microsoft Silverlight 5 before 5.1.50709.0 does not properly allocate memory for string-insert and string-append operations, which allows remote attackers to execute arbitrary code…
CVE-2015-6166, published 2015-12-09. High severity, CVSS 9.3. EPSS: 14.1% chance of exploitation in the next 30 days. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read or write access) via unspecified open and close…
CVE-2015-6165, published 2015-12-09. Medium severity, CVSS 4.3. EPSS: 16.3% chance of exploitation in the next 30 days. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Silverlight Information Disclosure Vulnerability," a…
CVE-2015-6114, published 2015-12-09. Medium severity, CVSS 4.3. EPSS: 19.1% chance of exploitation in the next 30 days. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Silverlight Information Disclosure Vulnerability," a…
CVE-2015-6108, published 2015-12-09. High severity, CVSS 9.3. EPSS: 26% chance of exploitation in the next 30 days. The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT Gold and 8.1; Office…