KLA10578 Multiple vulnerabilities in Microsoft Font Drivers

Multiple serious vulnerabilities have been found in Microsoft products. Malicious users can exploit these vulnerabilities to execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Improper fonts handling can be exploited remotely via a specially designed web site;
2. Improper fonts handling can be exploited remotely via a specially designed document or web site.

Original advisories

Microsoft Advisory

CVE-2015-1671

CVE-2015-1670

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Silverlight

Microsoft-Office-Live-Meeting-2007

Microsoft-Lync

Microsoft-Office

Microsoft-Lync-2010-Attendee

Microsoft-Windows-Vista-4

Microsoft-Windows-Server-2012

Microsoft-Windows-8

Microsoft-Windows-7

Microsoft-Windows-Server-2008

Microsoft-Windows-Server-2003

Windows-RT

CVE list

CVE-2015-1671 critical

CVE-2015-1670 warning

KB list

3045171

2881073

2883029

3051466

3056819

3039779

3048068

3048077

3048074

3051468

3048072

3048073

3048070

3048071

3051467

3057110

3051465

3051464

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

Affected Products

• Windows Server 2003 x86, x64, Itanium Service Pack 2Windows Vista x86, x64 Service Pack 2Windows Server 2008 x86, x64, Itanium Service Pack 2Windows 7 x86, x64 Service Pack 1Windows Server 2008 R2 x64, Itanium Service Pack 1Windows 8, 8.1 x86, x64Windows Server 2012Windows Server 2012 R2Windows RTWindows RT 8.1Office 2007 Service Pack 3Office 2010 Service Pack 2Live Meeting 2007 ConsoleMicrosoft Lync 2010Microsoft Lync 2010 AttendeeMicrosoft Lync 2013 Service Pack 1Microsoft Lync Basic 2013 Service Pack 1Microsoft Silverlight 5Microsoft Silverlight 5 Developer Runtime