# MA-353.072013: MyCERT Alert - Critical Vulnerabilities in .NET Framework and Silverlight Could Allow Remote Code Execution

**Date:** 10 Jul 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-353.072013  
**Advisory ID:** MA-353.072013

---

**1.0 Introduction**
A Critical Patch Update is a collection of patches for security vulnerabilities. Critical vulnerabilities have been identified in .NET Framework and Silverlight and patch has been released this month to address this issue.
**2.0 Impact**
This security update resolves five privately reported vulnerabilities and two publicly disclosed vulnerabilities in Microsoft .NET Framework and Microsoft Silverlight. The most severe of these vulnerabilities could allow remote code execution if a trusted application uses a particular pattern of code. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
**3.0 Affected Products**
- Microsoft Windows
- Microsoft .NET Framework
- Microsoft Silverlight
**4.0 Recommendation**
Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see [Microsoft Knowledge Base Article 294871](http://support.microsoft.com/kb/294871).
For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the [Microsoft Update](http://www.update.microsoft.com/windowsupdate/v6/thanks.aspx?ln=en&&thankspage=5) service.
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#42213b2027307b7b7b02213b20273031272137302b363b6c2f3b) or [[email protected]](/cdn-cgi/l/email-protection#1d70647e786f695d70647e786f6933726f7a337064)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**5.0 References**
- <https://technet.microsoft.com/en-us/security/bulletin/ms13-052>
- [http://blogs.technet.com/b/jeffa36/archive/2013/07/10/](http://blogs.technet.com/b/jeffa36/archive/2013/07/10/microsoft-security-bulletin-july-2013-release.aspx)