PT-2015-3443 · Microsoft · Lync Basic+7

Publicado 2015-05-12 · Atualizado 2025-10-22 · CVE-2015-1671

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 3.0 SP2 through 4.5.2 Microsoft Office versions 2007 SP3 through 2010 SP2 Microsoft Live Meeting version 2007 Console Microsoft Lync versions 2010 through 2013 SP1 Microsoft Lync Basic version 2013 SP1 Microsoft Silverlight versions 5 through 5.1.40416.00 Microsoft Silverlight Developer Runtime versions 5 through 5.1.40416.00

Description The vulnerability is related to errors in parsing TrueType fonts, which can allow remote attackers to execute arbitrary code via a crafted TrueType font. An attacker who successfully exploited this vulnerability could take complete control of the affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. This can be achieved by opening a specially crafted document or web page containing embedded TrueType fonts.

Recommendations For Microsoft .NET Framework versions 3.0 SP2 through 4.5.2, update to a newer version to mitigate the risk. For Microsoft Office versions 2007 SP3 through 2010 SP2, update to a newer version to mitigate the risk. For Microsoft Live Meeting version 2007 Console, update to a newer version to mitigate the risk. For Microsoft Lync versions 2010 through 2013 SP1, update to a newer version to mitigate the risk. For Microsoft Lync Basic version 2013 SP1, update to a newer version to mitigate the risk. For Microsoft Silverlight versions 5 through 5.1.40416.00, update to version 5.1.40416.00 or later to mitigate the risk. For Microsoft Silverlight Developer Runtime versions 5 through 5.1.40416.00, update to version 5.1.40416.00 or later to mitigate the risk. As a temporary workaround, consider restricting the use of TrueType fonts in affected applications until a patch is available.

Correção

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

BDU:2022-07293

CVE-2015-1671

Produtos afetados

.Net Framework

Live Meeting

Lync

Lync Basic

Office

Silverlight

Silverlight Developer Runtime

Windows

Referências · 17

• https://malware289.rssing.com/chan-4984036/all_p9.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1671 · Nota
• http://securityfocus.com/bid/74490 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1671 · Nota de Segurança
• http://securitytracker.com/id/1032281 · Nota
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Nota
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1671 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/ms15-044 · Nota
• https://t.me/cvenotify/118109 · Publicação no Telegram
• https://t.me/cvenotify/84809 · Publicação no Telegram
• https://t.me/cveNotify/139779 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-1671 · Nota de Segurança
• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 · Nota
• https://bdu.fstec.ru/vul/2022-07293 · Nota de Segurança