PT-2015-5743 · Microsoft · Office Graphics Library+6

Publicado 2015-08-11 · Atualizado 2018-10-12 · CVE-2015-2431

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2007 SP3 through 2010 SP2 Live Meeting 2007 Console version Lync 2010 version Lync 2010 Attendee version Lync 2013 version SP1 Lync Basic 2013 version SP1

Description A remote code execution issue exists due to improper handling of Office Graphics Library (OGL) fonts by Microsoft Office. This could allow an attacker to take complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office 2007 SP3, update to a newer version to mitigate the risk. For Microsoft Office 2010 SP2, update to a newer version to mitigate the risk. For Live Meeting 2007 Console, update to a newer version to mitigate the risk. For Lync 2010, update to a newer version to mitigate the risk. For Lync 2010 Attendee, update to a newer version to mitigate the risk. For Lync 2013 SP1, update to a newer version to mitigate the risk. For Lync Basic 2013 SP1, update to a newer version to mitigate the risk.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-2431

Produtos afetados

Live Meeting 2007 Console

Lync 2010

Lync 2010 Attendee

Lync 2013

Lync Basic 2013

Office

Office Graphics Library

Referências · 6

• 🔥 https://exploit-db.com/exploits/37911 · Exploit
• http://securitytracker.com/id/1033238 · Nota
• http://technet.microsoft.com/security/bulletin/ms15-080 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2431 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2431 · Nota de Segurança