Lucene search

K

[email protected]NVD:CVE-2015-2456

HistoryAug 15, 2015 - 12:59 a.m.

CVE-2015-2456

2015-08-1500:59:16

CWE-20

[email protected]

web.nvd.nist.gov

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.3 High

AI Score

Confidence

Low

0.122 Low

EPSS

Percentile

95.4%

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka “TrueType Font Parsing Vulnerability,” a different vulnerability than CVE-2015-2455.

Affected configurations

NVD

Node

microsoft.net_frameworkMatch3.0sp2

OR

microsoft.net_frameworkMatch4.0

OR

microsoft.net_frameworkMatch4.5

OR

microsoft.net_frameworkMatch4.5.1

OR

microsoft.net_frameworkMatch4.5.2

OR

microsoft.net_frameworkMatch4.6

AND

microsoftwindows_server_2008Match-sp2

OR

microsoftwindows_vistaMatch-sp2

Node

microsoft.net_frameworkMatch3.5.1

AND

microsoftwindows_7Match-sp1

OR

microsoftwindows_server_2008Matchr2sp1x64

Node

microsoft.net_frameworkMatch3.5

AND

microsoftwindows_10Match-

OR

microsoftwindows_8Match-

OR

microsoftwindows_8.1Match-

OR

microsoftwindows_server_2012

OR

microsoftwindows_server_2012Matchr2

Node

microsoftlive_meetingMatch2007

OR

microsoftlyncMatch2010

OR

microsoftlyncMatch2010attendee

OR

microsoftlyncMatch2013sp1

OR

microsoftlync_basicMatch2013sp1

OR

microsoftofficeMatch2007sp3

OR

microsoftofficeMatch2010sp2

OR

microsoftsilverlightRange≤5.1.40416.0

Node

microsoftwindows_10Match-

OR

microsoftwindows_7Match-

OR

microsoftwindows_8Match-

OR

microsoftwindows_8.1Match-

OR

microsoftwindows_rtMatch-

OR

microsoftwindows_rt_8.1Match-

OR

microsoftwindows_server_2008Match-sp2

OR

microsoftwindows_server_2008Matchr2sp1itanium

OR

microsoftwindows_server_2008Matchr2sp1x64

OR

microsoftwindows_server_2012Match-

OR

microsoftwindows_server_2012Matchr2

OR

microsoftwindows_vistaMatch-sp2

References

www.securityfocus.com/bid/76241

www.securitytracker.com/id/1033238

docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080

www.exploit-db.com/exploits/37918/

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.3 High

AI Score

Confidence

Low

0.122 Low

EPSS

Percentile

95.4%

Related for NVD:CVE-2015-2456

cvelist2 cve2 nvd1 prion2 nessus2 symantec2 checkpoint_advisories2 zdt2 openvas8 zdi1 googleprojectzero1 mskb1 kaspersky1 securityvulns1