PT-2015-2953 · Microsoft · Windows 7+3

Published 2015-12-08 · Updated 2018-10-12 · CVE-2015-6130

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is caused by an integer underflow in Uniscribe, allowing remote attackers to execute arbitrary code via a crafted font. A remote code execution vulnerability exists when Windows Uniscribe improperly parses specially crafted fonts. An attacker who successfully exploited the issue could install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1, update to a version that includes the fix for the integer underflow in Uniscribe. For other affected versions of Microsoft Windows, apply the necessary patch or update to resolve the remote code execution vulnerability. As a temporary workaround, consider restricting the use of specially crafted fonts to minimize the risk of exploitation.

Exploit

Fix

RCE

Integer Underflow

Weakness Enumeration

CWE-189

CWE-191

Related Identifiers

BDU:2016-00050

CVE-2015-6130

Affected Products

Uniscribe

Windows

Windows 7

Windows Server 2008 R2

References · 8

• 🔥 http://blogs.flexerasoftware.com/secunia-research/2015/12/vulnerability-in-microsofts-unicode-scripts-processor-allows-execution-of-arbitrary-code.html · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-130 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00050 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6130 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6130 · Security Note
• http://securitytracker.com/id/1034337 · Note
• http://technet.microsoft.com/security/bulletin/ms15-130 · Note
• http://technet.microsoft.com/security/bulletin/MS15-130 · Note