PT-2015-5752 · Microsoft · Windows Rt+12

Published 2015-08-15 · Updated 2019-05-15 · CVE-2015-2456

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold and 8.1 Microsoft Windows 10 Microsoft Office 2007 SP3 and 2010 SP2 Microsoft Live Meeting 2007 Console Microsoft Lync 2010 Microsoft Lync 2010 Attendee Microsoft Lync 2013 SP1 Microsoft Lync Basic 2013 SP1 Microsoft Silverlight versions prior to 5.1.40728 Microsoft .NET Framework versions 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6

Description The issue allows remote attackers to execute arbitrary code via a crafted TrueType font.

Recommendations For Microsoft Windows Vista SP2, apply the relevant patch. For Microsoft Windows Server 2008 SP2 and R2 SP1, apply the relevant patch. For Microsoft Windows 7 SP1, apply the relevant patch. For Microsoft Windows 8, apply the relevant patch. For Microsoft Windows 8.1, apply the relevant patch. For Microsoft Windows Server 2012 Gold and R2, apply the relevant patch. For Microsoft Windows RT Gold and 8.1, apply the relevant patch. For Microsoft Windows 10, apply the relevant patch. For Microsoft Office 2007 SP3 and 2010 SP2, apply the relevant patch. For Microsoft Live Meeting 2007 Console, apply the relevant patch. For Microsoft Lync 2010, apply the relevant patch. For Microsoft Lync 2010 Attendee, apply the relevant patch. For Microsoft Lync 2013 SP1, apply the relevant patch. For Microsoft Lync Basic 2013 SP1, apply the relevant patch. For Microsoft Silverlight, update to version 5.1.40728 or later. For Microsoft .NET Framework versions 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6, apply the relevant patch.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-2456

Affected Products

.Net Framework

Live Meeting

Lync

Office

Silverlight

Windows 10

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2008

Windows Server 2012

Windows Vista

References · 6

• 🔥 https://exploit-db.com/exploits/37918 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2456 · Security Note
• http://securitytracker.com/id/1033238 · Note
• http://securityfocus.com/bid/76241 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2456 · Note