PT-2012-4345 · Microsoft+1 · Windows Rt+9

Eetu Luodemaa + 1 · Publicado 2012-09-25 · Atualizado 2025-01-16 · CVE-2012-2897

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista version SP2 Microsoft Windows Server 2008 versions SP2 through R2 SP1 Microsoft Windows 7 versions Gold through SP1 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows RT Google Chrome versions prior to 22.0.1229.79

Description A remote code execution issue exists due to improper handling of objects in memory when processing specially crafted TrueType font files. This could allow remote attackers to execute arbitrary code, potentially giving them complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full administrative rights.

Recommendations For Microsoft Windows XP versions SP2 through SP3, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Server 2003 version SP2, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Vista version SP2, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Server 2008 versions SP2 through R2 SP1, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows 7 versions Gold through SP1, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows 8, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Server 2012, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows RT, apply the patch provided by Microsoft to fix the issue. For Google Chrome versions prior to 22.0.1229.79, update to version 22.0.1229.79 or later to fix the issue. As a temporary workaround, consider avoiding the use of TrueType font files from untrusted sources until a patch is available.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-2897

Produtos afetados

Google Chrome

Windows

Windows 7

Windows 8

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

Windows Xp

Referências · 14

• http://secunia.com/advisories/51239 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms12-075 · Nota
• https://t.me/cvenotify/107705 · Publicação no Telegram
• http://us-cert.gov/cas/techalerts/TA12-318A.html · Nota
• http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html · Nota
• https://code.google.com/p/chromium/issues/detail?id=146254 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15847 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78822 · Nota
• http://securitytracker.com/id?1027750 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2897 · Nota de Segurança
• https://crbug.com/146254 · Nota
• https://chromereleases.googleblog.com/2012/09/stable-channel-update_25.html · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2897 · Nota de Segurança