Microsoft Windows GDI+ CVE-2015-1670 OpenType Font Parsing Information Disclosure Vulnerability
BID:74485
Info
Microsoft Windows GDI+ CVE-2015-1670 OpenType Font Parsing Information Disclosure Vulnerability
| Bugtraq ID: | 74485 |
| Class: | Design Error |
| CVE: |
CVE-2015-1670 |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2015 12:00AM |
| Updated: | Jul 15 2015 12:45AM |
| Credit: | Mateusz Jurczyk of Google Project Zero. |
| Vulnerable: |
Microsoft Windows Vista Service Pack 2 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Avaya Messaging Application Server 5.2 Avaya Meeting Exchange - Webportal 0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 |
| Not Vulnerable: | |
Discussion
Microsoft Windows GDI+ CVE-2015-1670 OpenType Font Parsing Information Disclosure Vulnerability
Microsoft Windows GDI+ is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.
Microsoft Windows GDI+ is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.
Exploit / POC
Microsoft Windows GDI+ CVE-2015-1670 OpenType Font Parsing Information Disclosure Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Microsoft Windows GDI+ CVE-2015-1670 OpenType Font Parsing Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Microsoft Windows GDI+ CVE-2015-1670 OpenType Font Parsing Information Disclosure Vulnerability
References:
References:
- Microsoft Homepage (Microsoft)
- One font vulnerability to rule them all (mjurczyk)
- Results of my recent PostScript Charstring security research unveiled (j00ru)
- Microsoft Security Bulletin MS15-044 - Critical (Microsoft)
- MS15-044 Vulnerabilities in Microsoft Font Drivers Could Allow Remote Code Execu (Avaya)