9.3

CVE-2015-1671

Warnung
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ .Net Framework Version 3.0 Update sp2
   Microsoft ≫ Windows Server 2003 Version - Update sp2 HwPlatform x64
Microsoft ≫ .Net Framework Version 4.0 Update -
   Microsoft ≫ Windows Server 2003 Version - Update sp2 HwPlatform x64
Microsoft ≫ .Net Framework Version 3.0 Update sp2
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x86
   Microsoft ≫ Windows Vista Version - Update sp2
Microsoft ≫ .Net Framework Version 4.0 Update -
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x86
   Microsoft ≫ Windows Vista Version - Update sp2
Microsoft ≫ .Net Framework Version 4.5
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x86
   Microsoft ≫ Windows Vista Version - Update sp2
Microsoft ≫ .Net Framework Version 4.5.1
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x86
   Microsoft ≫ Windows Vista Version - Update sp2
Microsoft ≫ .Net Framework Version 4.5.2
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x86
   Microsoft ≫ Windows Vista Version - Update sp2
Microsoft ≫ .Net Framework Version 3.5.1
   Microsoft ≫ Windows 7 Version - Update sp1
Microsoft ≫ .Net Framework Version 3.5 Update -
   Microsoft ≫ Windows 8 Version -
   Microsoft ≫ Windows 8.1 Version -
   Microsoft ≫ Windows Server 2012 Version -
   Microsoft ≫ Windows Server 2012 Version r2
Microsoft ≫ .Net Framework Version 3.5 Update -
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
Microsoft ≫ .Net Framework Version 3.5.1
   Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
Microsoft ≫ Live Meeting Version 2007
Microsoft ≫ Lync Version 2010 SwEdition attendee
Microsoft ≫ Lync Version 2013 Update sp1
Microsoft ≫ Silverlight Version 5.0

25.05.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Remote Code Execution Vulnerability

Schwachstelle

A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 54.63% 0.989
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.securitytracker.com/id/1032281
Third Party Advisory
Broken Link
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044
Patch
Vendor Advisory
http://www.securityfocus.com/bid/74490
Third Party Advisory
Broken Link
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1671
US Government Resource