PT-2015-5743 · Microsoft · Office Graphics Library+6

Published 2015-08-11 · Updated 2018-10-12 · CVE-2015-2431

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2007 SP3 through 2010 SP2 Live Meeting 2007 Console version Lync 2010 version Lync 2010 Attendee version Lync 2013 version SP1 Lync Basic 2013 version SP1

Description A remote code execution issue exists due to improper handling of Office Graphics Library (OGL) fonts by Microsoft Office. This could allow an attacker to take complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office 2007 SP3, update to a newer version to mitigate the risk. For Microsoft Office 2010 SP2, update to a newer version to mitigate the risk. For Live Meeting 2007 Console, update to a newer version to mitigate the risk. For Lync 2010, update to a newer version to mitigate the risk. For Lync 2010 Attendee, update to a newer version to mitigate the risk. For Lync 2013 SP1, update to a newer version to mitigate the risk. For Lync Basic 2013 SP1, update to a newer version to mitigate the risk.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-2431

Affected Products

Live Meeting 2007 Console

Lync 2010

Lync 2010 Attendee

Lync 2013

Lync Basic 2013

Office

Office Graphics Library

References · 6

• 🔥 https://exploit-db.com/exploits/37911 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2431 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2431 · Security Note
• http://securitytracker.com/id/1033238 · Note
• http://technet.microsoft.com/security/bulletin/ms15-080 · Note