PT-2015-3443 · Microsoft · Lync Basic+7

Published 2015-05-12 · Updated 2025-10-22 · CVE-2015-1671

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 3.0 SP2 through 4.5.2 Microsoft Office versions 2007 SP3 through 2010 SP2 Microsoft Live Meeting version 2007 Console Microsoft Lync versions 2010 through 2013 SP1 Microsoft Lync Basic version 2013 SP1 Microsoft Silverlight versions 5 through 5.1.40416.00 Microsoft Silverlight Developer Runtime versions 5 through 5.1.40416.00

Description The vulnerability is related to errors in parsing TrueType fonts, which can allow remote attackers to execute arbitrary code via a crafted TrueType font. An attacker who successfully exploited this vulnerability could take complete control of the affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. This can be achieved by opening a specially crafted document or web page containing embedded TrueType fonts.

Recommendations For Microsoft .NET Framework versions 3.0 SP2 through 4.5.2, update to a newer version to mitigate the risk. For Microsoft Office versions 2007 SP3 through 2010 SP2, update to a newer version to mitigate the risk. For Microsoft Live Meeting version 2007 Console, update to a newer version to mitigate the risk. For Microsoft Lync versions 2010 through 2013 SP1, update to a newer version to mitigate the risk. For Microsoft Lync Basic version 2013 SP1, update to a newer version to mitigate the risk. For Microsoft Silverlight versions 5 through 5.1.40416.00, update to version 5.1.40416.00 or later to mitigate the risk. For Microsoft Silverlight Developer Runtime versions 5 through 5.1.40416.00, update to version 5.1.40416.00 or later to mitigate the risk. As a temporary workaround, consider restricting the use of TrueType fonts in affected applications until a patch is available.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

BDU:2022-07293

CVE-2015-1671

Affected Products

.Net Framework

Live Meeting

Lync

Lync Basic

Office

Silverlight

Silverlight Developer Runtime

Windows

References · 17

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1671 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1671 · Security Note
• https://bdu.fstec.ru/vul/2022-07293 · Security Note
• https://malware289.rssing.com/chan-4984036/all_p9.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1671 · Note
• http://securityfocus.com/bid/74490 · Note
• http://securitytracker.com/id/1032281 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1671 · Note
• http://technet.microsoft.com/security/bulletin/ms15-044 · Note
• https://t.me/cvenotify/118109 · Telegram Post
• https://t.me/cvenotify/84809 · Telegram Post
• https://t.me/cveNotify/139779 · Telegram Post
• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 · Note