PT-2011-3543 · Microsoft · Windows 7+2

Will Dorman · Published 2011-11-08 · Updated 2020-09-28 · CVE-2011-2004

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 and R2 SP1 Microsoft Windows 7 Gold and SP1

Description A denial of service issue exists in the Microsoft Windows kernel, caused by improper processing of a specifically crafted TrueType font file. This could allow remote attackers to cause the system to stop responding and restart.

Recommendations For Microsoft Windows Server 2008 R2 and R2 SP1, update to a version that includes the fix for this issue. For Microsoft Windows 7 Gold and SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of TrueType font files from untrusted sources to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-2004

Affected Products

Windows 7

Windows Server 2008 R2

Windows

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2004 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2004 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-084 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/MS11-084 · Note
• http://kb.cert.org/vuls/id/675073 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14133 · Note