PT-2012-4345 · Microsoft+1 · Windows Rt+9

Eetu Luodemaa + 1 · Published 2012-09-25 · Updated 2025-01-16 · CVE-2012-2897

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista version SP2 Microsoft Windows Server 2008 versions SP2 through R2 SP1 Microsoft Windows 7 versions Gold through SP1 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows RT Google Chrome versions prior to 22.0.1229.79

Description A remote code execution issue exists due to improper handling of objects in memory when processing specially crafted TrueType font files. This could allow remote attackers to execute arbitrary code, potentially giving them complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full administrative rights.

Recommendations For Microsoft Windows XP versions SP2 through SP3, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Server 2003 version SP2, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Vista version SP2, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Server 2008 versions SP2 through R2 SP1, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows 7 versions Gold through SP1, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows 8, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows Server 2012, apply the patch provided by Microsoft to fix the issue. For Microsoft Windows RT, apply the patch provided by Microsoft to fix the issue. For Google Chrome versions prior to 22.0.1229.79, update to version 22.0.1229.79 or later to fix the issue. As a temporary workaround, consider avoiding the use of TrueType font files from untrusted sources until a patch is available.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-2897

Affected Products

Google Chrome

Windows

Windows 7

Windows 8

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

Windows Xp

References · 14

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2897 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2897 · Security Note
• http://secunia.com/advisories/51239 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-075 · Note
• https://t.me/cvenotify/107705 · Telegram Post
• http://us-cert.gov/cas/techalerts/TA12-318A.html · Note
• http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html · Note
• https://code.google.com/p/chromium/issues/detail?id=146254 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15847 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78822 · Note
• http://securitytracker.com/id?1027750 · Note
• https://crbug.com/146254 · Note
• https://chromereleases.googleblog.com/2012/09/stable-channel-update_25.html · Note