PT-2011-3541 · Microsoft · Windows+3

Maik Wellmann · Published 2011-10-11 · Updated 2023-12-07 · CVE-2011-2002

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description A denial of service issue exists due to improper handling of TrueType fonts. This could allow local users to cause a system hang via a crafted font file. An attacker who successfully exploits this issue could cause the affected system to stop responding.

Recommendations For Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1, update to a version that properly handles TrueType fonts to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-2002

Affected Products

Windows

Windows 7

Windows Server 2008

Windows Vista

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-2002 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2002 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-077 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/MS11-077 · Note
• http://securityfocus.com/bid/49973 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13024 · Note
• http://securitytracker.com/id?1026165 · Note