60
CVE-2016-0034
Remote Code Execution via Crafted Website in Microsoft Silverlight 5
CISA: Microsoft Silverlight Runtime Remote Code Execution Vulnerability
- CVSS 3.1
- 8.8 high
- EPSS
- 69%p99
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2016-0034 is a memory-corruption flaw in the Microsoft Silverlight 5 runtime, which mishandles negative offsets during decoding, corrupting object headers. An attacker triggers it by convincing a user to visit a crafted website while the vulnerable Silverlight plug-in is active in their browser, requiring no privileges but user interaction. Successful exploitation allows the attacker to execute arbitrary code in the context of the logged-in user (or crash the browser/application). Anyone running Microsoft Silverlight 5 versions before 5.1.41212.0 is affected; Silverlight is now end-of-life, so remaining installations are legacy deployments. The flaw was exploited in the wild through exploit kits such as Angler and RIG to deliver ransomware like Cerber, and it was added to the CISA KEV catalog in May 2022 with known ransomware use.
What to do: Upgrade Silverlight to version 5.1.41212.0 (January 2016 security update) on any system where it remains installed. Because Silverlight is end-of-life, CISA's KEV required action is to disconnect or remove it and migrate any legacy Silverlight-based web applications; prioritize internet-facing endpoints and users of Internet Explorer/legacy browsers, where the plug-in can still be invoked.
| Product | Affected |
|---|---|
| microsoft Silverlight | Silverlight 5 before 5.1.41212.0 (fixed in 5.1.41212.0, January 2016 Patch Tuesday) |
Estimated exposure
masshistorically hundreds of millions of installs (Silverlight reached roughly 70% of consumer devices at peak); residual active installs today likely number in… — Silverlight shipped broadly with Windows and Microsoft reported very high consumer penetration at its peak, and it remained widely deployed in enterprise line-of-business browser apps, though the plug-in is now end-of-life and most modern…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
KEVCISA Known Exploited Vulnerability
- Affected
- Microsoft Silverlight
- Required action
- The impacted products are end-of-life and should be disconnected if still in use.
- Due date
- Ransomware use
- Known
In the news
8 stories60
60
60
60
60
47
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
36