MS13-094: Vulnerability in Microsoft Outlook Could Allow Information Disclosure (2894514)

Medium Nessus Plugin ID 70852


The version of Microsoft Outlook installed on the remote Windows host is affected by an information disclosure vulnerability.


The Outlook component of Microsoft Office is affected by an information disclosure vulnerability due to a flaw in how Outlook parses S/MIME messages. It is possible for a remote attacker to exploit the vulnerability if a user opens or previews a specially crafted email in an affected version of Outlook.


Microsoft has released a set of patches for Office 2007, 2010, 2013 and 2013 RT.

See Also

Plugin Details

Severity: Medium

ID: 70852

File Name: smb_nt_ms13-094.nasl

Version: 1.9

Type: local

Agent: windows

Published: 2013/11/13

Updated: 2019/11/27

Dependencies: 13855, 27524, 57033

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2013-3905

CVSS v2.0

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:microsoft:office:2007, cpe:/a:microsoft:office:2010, cpe:/a:microsoft:office:2013

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/11/12

Vulnerability Publication Date: 2013/11/12

Reference Information

CVE: CVE-2013-3905

BID: 63603

MSFT: MS13-094

MSKB: 2825644, 2837597, 2837618