PT-2018-9069 · Microsoft+1 · Windows Server 2008 R2 Sp1+8

Mateusz Jurczyk · Published 2018-01-03 · Updated 2019-10-03 · CVE-2018-0788

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows 7 SP1 Windows 8.1 Windows RT 8.1 Windows Server 2008 SP2 Windows Server 2008 R2 SP1 Windows Server 2012 Windows Server 2012 R2

Description: The issue is related to the way objects are handled in memory by the Windows Adobe Type Manager Font Driver (Atmfd.dll), allowing an elevation of privilege. This could enable attackers to obtain sensitive information and affect the system.

Recommendations: For Windows 7 SP1, update to a newer version that addresses the issue. For Windows 8.1, update to a newer version that addresses the issue. For Windows RT 8.1, update to a newer version that addresses the issue. For Windows Server 2008 SP2, update to a newer version that addresses the issue. For Windows Server 2008 R2 SP1, update to a newer version that addresses the issue. For Windows Server 2012, update to a newer version that addresses the issue. For Windows Server 2012 R2, update to a newer version that addresses the issue.

Fix

Related Identifiers

CVE-2018-0788

Affected Products

Type Manager Font Driver

Windows

Windows 7 Sp1

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2 Sp1

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0788 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0788 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-0788 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0788 · Security Note
• http://securityfocus.com/bid/102364 · Note
• http://securitytracker.com/id/1040092 · Note