CVE-2015-1671

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-1671
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.securityfocus.com/bid/74490 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032281 Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.5.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
OR cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

Configuration 6 (hide)

OR cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:*
cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:silverlight:5.0:*:*:*:*:*:*:*
History

28 Jun 2024, 17:26

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/74490 - () http://www.securityfocus.com/bid/74490 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1032281 - () http://www.securitytracker.com/id/1032281 - Broken Link, Third Party Advisory, VDB Entry
References () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 - () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 - Patch, Vendor Advisory
First Time Microsoft windows Server 2003
Microsoft windows Server 2008
Microsoft windows 7
Microsoft windows 8
Microsoft windows Server 2012
Microsoft windows 8.1
Microsoft windows Vista
CWE CWE-19 NVD-CWE-noinfo
CPE cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:silverlight:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x64:*
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x86:*
cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:x86:*
cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:x64:*
cpe:2.3:a:microsoft:silverlight:*:developer_runtime:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*		 cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
cpe:2.3:a:microsoft:silverlight:5.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
CVSS v2 : 9.3
v3 : unknown 		v2 : 9.3
v3 : 7.8
Information

Published : 2015-05-13 10:59

Updated : 2024-06-28 17:26

NVD link : CVE-2015-1671

Mitre link : CVE-2015-1671

CVE.ORG link : CVE-2015-1671

JSON object : View

Products Affected

microsoft

  • lync
  • silverlight
  • windows_server_2008
  • windows_7
  • windows_8
  • windows_server_2003
  • windows_vista
  • windows_8.1
  • live_meeting
  • .net_framework
  • windows_server_2012
CWE
NVD-CWE-noinfo