8.8

CVE-2020-1020

Warnung
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
Microsoft ≫ Windows 10 1507 Version - HwPlatform x86
Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
Microsoft ≫ Windows 10 1709 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1803 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
Microsoft ≫ Windows 10 1803 Version - HwPlatform x86
Microsoft ≫ Windows 10 1809 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
Microsoft ≫ Windows 10 1809 Version - HwPlatform x86
Microsoft ≫ Windows 10 1903 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1903 Version - HwPlatform x64
Microsoft ≫ Windows 10 1903 Version - HwPlatform x86
Microsoft ≫ Windows 10 1909 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1909 Version - HwPlatform x64
Microsoft ≫ Windows 10 1909 Version - HwPlatform x86
Microsoft ≫ Windows 7 Version - Update sp1
Microsoft ≫ Windows 8.1 Version -
Microsoft ≫ Windows Rt 8.1 Version -
Microsoft ≫ Windows Server 2008 Version - Update sp2
Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform itanium
Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability

Schwachstelle

Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 65.04% 0.991
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020
Patch
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1020
US Government Resource