CVE-2015-6106

2015-12-0911:59:00

CWE-119

[email protected]

web.nvd.nist.gov

windows

font

library

microsoft

vista

windows server

office

word viewer

skype for business

lync

live meeting

remote code execution

vulnerability

7.3 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.427 Medium

EPSS

Percentile

97.3%

JSON

The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka “Graphics Memory Corruption Vulnerability.”

CPENameOperatorVersion
microsoft:lyncmicrosoft lynceq2010
microsoft:live_meetingmicrosoft live meetingeq2007
microsoft:officemicrosoft officeeq2007
microsoft:officemicrosoft officeeq2010
microsoft:windows_server_2008microsoft windows server 2008eq-
microsoft:lyncmicrosoft lynceq2013
microsoft:skype_for_businessmicrosoft skype for businesseq2016
microsoft:word_viewermicrosoft word viewereq*
microsoft:windows_vistamicrosoft windows vistaeq-

CPE	Name	Operator	Version
microsoft:lync	microsoft lync	eq	2010
microsoft:live_meeting	microsoft live meeting	eq	2007
microsoft:office	microsoft office	eq	2007
microsoft:office	microsoft office	eq	2010
microsoft:windows_server_2008	microsoft windows server 2008	eq	-
microsoft:lync	microsoft lync	eq	2013
microsoft:skype_for_business	microsoft skype for business	eq	2016
microsoft:word_viewer	microsoft word viewer	eq	*
microsoft:windows_vista	microsoft windows vista	eq	-