Microsoft SharePoint Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability?
In a network-based attack an attacker would need to have the privileges to create a page on a vulnerable SharePoint server. By creating a site using specific code, the attacker could execute code remotely on the target server.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated and possess the permissions for page creation to be able to exploit this vulnerability.

I am running SharePoint Enterprise Server 2013 Service Pack 1. Do I need to install both updates that are listed for SharePoint Enterprise Server 2013 Service Pack 1?
No. The Cumulative update for SharePoint Server 2013 includes the update for Foundation Server 2013. Customers running SharePoint Server 2013 Service Pack 1 can install the cumulative update or the security update, which is the same update as for Foundation Server 2013.
Please note that this is a clarification of the existing servicing model for SharePoint Server 2013 and applies for all previous updates.

Security updates
16.0.5361.1002 — https://support.microsoft.com/kb/5002269
15.0.5485.1000 — https://support.microsoft.com/kb/5002264
15.0.5485.1000 — https://support.microsoft.com/kb/5002267
16.0.10390.20000 — https://support.microsoft.com/kb/5002258
16.0.15601.20052 — https://support.microsoft.com/kb/5002271