Lucene search

[email protected]CVE-2010-0018

HistoryJan 13, 2010 - 7:30 p.m.

CVE-2010-0018

2010-01-1319:30:00

CWE-189

[email protected]

web.nvd.nist.gov

cve-2010-0018

eot font engine

microsoft windows

integer overflow

remote code execution

lzcomp decompressor vulnerability

7.6 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.958 High

EPSS

Percentile

99.4%

JSON

Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code via compressed data that represents a crafted EOT font, aka “Microtype Express Compressed Fonts Integer Flaw in the LZCOMP Decompressor Vulnerability.”

CPENameOperatorVersion
microsoft:windows_server_2008microsoft windows server 2008eq*
microsoft:windows_2003_servermicrosoft windows 2003 servereq*
microsoft:windows_xpmicrosoft windows xpeq*
microsoft:windows_server_2008microsoft windows server 2008eq-
microsoft:windows_xpmicrosoft windows xpeq-
microsoft:windows_vistamicrosoft windows vistaeq*
microsoft:windows_2000microsoft windows 2000eq*
microsoft:windows_7microsoft windows 7eq-

CPE	Name	Operator	Version
microsoft:windows_server_2008	microsoft windows server 2008	eq	*
microsoft:windows_2003_server	microsoft windows 2003 server	eq	*
microsoft:windows_xp	microsoft windows xp	eq	*
microsoft:windows_server_2008	microsoft windows server 2008	eq	-
microsoft:windows_xp	microsoft windows xp	eq	-
microsoft:windows_vista	microsoft windows vista	eq	*
microsoft:windows_2000	microsoft windows 2000	eq	*
microsoft:windows_7	microsoft windows 7	eq	-

References

blogs.technet.com/srd/archive/2010/01/12/ms10-001-font-file-decompression-vulnerability.aspx

osvdb.org/61651

secunia.com/advisories/35457

www.securityfocus.com/bid/37671

www.securitytracker.com/id?1023432

www.us-cert.gov/cas/techalerts/TA10-012B.html

www.vupen.com/english/advisories/2010/0095

docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-001

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8324

7.6 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.958 High

EPSS

Percentile

99.4%

JSON

Related for CVE-2010-0018

checkpoint_advisories3 securityvulns3 nessus1 openvas2 prion1