Lucene search

MicrosoftCVE-2015-1671

HistoryMay 13, 2015 - 10:59 a.m.

CVE-2015-1671

2015-05-1310:59:03

microsoft

web.nvd.nist.gov

900

In Wild

windows

directwrite

microsoft

.net framework

office

live meeting

lync

silverlight

truetype font

cve-2015-1671

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

Low

EPSS

0.875

Percentile

98.7%

JSON

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka “TrueType Font Parsing Vulnerability.”

Affected configurations

Nvd

Node

microsoft.net_frameworkMatch3.0sp2

microsoft.net_frameworkMatch4.0-

AND

microsoftwindows_server_2003Match-sp2x64

Node

microsoft.net_frameworkMatch3.0sp2

microsoft.net_frameworkMatch4.0-

microsoft.net_frameworkMatch4.5

microsoft.net_frameworkMatch4.5.1

microsoft.net_frameworkMatch4.5.2

AND

microsoftwindows_server_2008Match-sp2x64

microsoftwindows_server_2008Match-sp2x86

microsoftwindows_vistaMatch-sp2

Node

microsoft.net_frameworkMatch3.5.1

AND

microsoftwindows_7Match-sp1

Node

microsoft.net_frameworkMatch3.5-

AND

microsoftwindows_8Match-

microsoftwindows_8.1Match-

microsoftwindows_server_2012Match-

microsoftwindows_server_2012Matchr2

Node

microsoft.net_frameworkMatch3.5-

microsoft.net_frameworkMatch3.5.1

AND

microsoftwindows_server_2008Matchr2sp1x64

Node

microsoftlive_meetingMatch2007

microsoftlyncMatch2010attendee

microsoftlyncMatch2013sp1

microsoftsilverlightMatch5.0

VendorProductVersionCPE
microsoft.net_framework3.0cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
microsoft.net_framework4.0cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
microsoftwindows_server_2003-cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*
microsoft.net_framework4.5cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*
microsoft.net_framework4.5.1cpe:2.3:a:microsoft:.net_framework:4.5.1:*:*:*:*:*:*:*
microsoft.net_framework4.5.2cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
microsoftwindows_server_2008-cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
microsoftwindows_server_2008-cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
microsoftwindows_vista-cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
microsoft.net_framework3.5.1cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	.net_framework	3.0	cpe:2.3:a:microsoft:.net_framework:3.0:sp2::::::
microsoft	.net_framework	4.0	cpe:2.3:a:microsoft:.net_framework:4.0:-::::::
microsoft	windows_server_2003	-	cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::x64:*
microsoft	.net_framework	4.5	cpe:2.3:a:microsoft:.net_framework:4.5:::::::*
microsoft	.net_framework	4.5.1	cpe:2.3:a:microsoft:.net_framework:4.5.1:::::::*
microsoft	.net_framework	4.5.2	cpe:2.3:a:microsoft:.net_framework:4.5.2:::::::*
microsoft	windows_server_2008	-	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
microsoft	windows_server_2008	-	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
microsoft	windows_vista	-	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
microsoft	.net_framework	3.5.1	cpe:2.3:a:microsoft:.net_framework:3.5.1:::::::*