PT-2020-3206 · Microsoft+1 · Windows Font Library+2

Published 2020-07-14 · Updated 2022-05-03 · CVE-2020-1436

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Font Library versions prior to the fixed version

Description The issue is related to the improper handling of specially crafted fonts by the Windows font library, allowing a remote attacker to execute arbitrary code. This can lead to remote code execution, enabling the attacker to perform actions on the affected system. The vulnerability affects systems except for Windows 10.

Recommendations For versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting the use of specially crafted fonts until a patch is available. Avoid using potentially vulnerable font files in the affected systems to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

ALT-PU-2020-2670

ALT-PU-2020-2837

BDU:2020-03504

CVE-2020-1436

ZDI-20-877

Affected Products

Alt Linux

Windows

Windows Font Library

References · 11

• https://zerodayinitiative.com/advisories/ZDI-20-877 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1436 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03504 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1436 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1436 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1436 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-1436 · Vendor Advisory
• http://openwall.com/lists/oss-security/2020/08/25/5 · Note
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://t.me/cvenotify/5011 · Telegram Post
• http://openwall.com/lists/oss-security/2020/08/25/3 · Note