PT-2015-2024 · Microsoft+1 · Windows Vista+11

Published 2015-09-08 · Updated 2018-10-12 · CVE-2015-2510

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 Microsoft Office 2007 SP3 Microsoft Office 2010 SP2 Microsoft Lync 2010 Microsoft Lync 2010 Attendee Microsoft Lync 2013 SP1 Microsoft Lync Basic 2013 SP1 Microsoft Live Meeting 2007 Console

Description A buffer overflow in the Adobe Type Manager Library allows remote attackers to execute arbitrary code via a crafted OpenType font. This issue is caused by the improper handling of specially crafted OpenType fonts by components of Windows, Office, and Lync. An attacker who successfully exploits this issue could take control of the affected system, then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows Vista SP2, update to a newer version that contains a fix for this issue. For Microsoft Windows Server 2008 SP2, update to a newer version that contains a fix for this issue. For Microsoft Office 2007 SP3, update to a newer version that contains a fix for this issue. For Microsoft Office 2010 SP2, update to a newer version that contains a fix for this issue. For Microsoft Lync 2010, update to a newer version that contains a fix for this issue. For Microsoft Lync 2010 Attendee, update to a newer version that contains a fix for this issue. For Microsoft Lync 2013 SP1, update to a newer version that contains a fix for this issue. For Microsoft Lync Basic 2013 SP1, update to a newer version that contains a fix for this issue. For Microsoft Live Meeting 2007 Console, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting the use of specially crafted OpenType fonts until a patch is available.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-11370

CVE-2015-2510

Affected Products

Type Manager Library

Live Meeting 2007

Lync 2010

Lync 2010 Attendee

Lync 2013

Lync Basic 2013

Office

Office 2007

Office 2010

Windows

Windows Server 2008

Windows Vista

References · 11

• 🔥 https://exploit-db.com/exploits/38217 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2510 · Security Note
• https://bdu.fstec.ru/vul/2015-11370 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2510 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-097 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/ms15-097 · Note
• http://securityfocus.com/bid/76593 · Note
• http://technet.microsoft.com/security/bulletin/MS15-097 · Note
• http://securitytracker.com/id/1033500 · Note
• http://securitytracker.com/id/1033501 · Note
• http://securitytracker.com/id/1033485 · Note