MS13-024  Vulnerabilities in SharePoint Could Allow Elevation of Privilege

2013-03-12 This security update resolves four privately reported vulnerabilities in Microsoft SharePoint and Microsoft SharePoint Foundation. The most severe vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes the user to a targeted SharePoint site.
Vulnerabilities addressed in this bulletin:

Callback Function Vulnerability

An elevation of privilege exists in Microsoft SharePoint Server. An attacker who successfully exploited this vulnerability could allow an attacker, after obtaining sensitive system data, elevate their access to the server.
CVE-2013-0080

SharePoint XSS Vulnerability

An elevation of privilege exists in Microsoft SharePoint Server. An attacker who successfully exploited this vulnerability could potentially issue SharePoint commands in the context of an administrative user on the site.
CVE-2013-0083

SharePoint XSS Vulnerability

An elevation of privilege exists in Microsoft SharePoint Server. An attacker who successfully exploited this vulnerability could allow an attacker, after obtaining sensitive system data, elevate their access to the server.
CVE-2013-0084

Buffer Overflow Vulnerability

A denial of service vulnerability exists in Microsoft SharePoint Server. An attacker who successfully exploited this vulnerability could cause the W3WP process on an affected version of SharePoint Server to terminate, causing the SharePoint site, and any other sites running under that process, to become unavailable until the process is restarted.
CVE-2013-0085

Bulletin details at Microsoft.com