CVE-2015-6107

2015-12-0911:59:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2015-6107

windows

font library

remote code execution

microsoft

vista

windows 7

windows 8

windows 10

office

word viewer

skype

lync

live meeting

7.3 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.949 High

EPSS

Percentile

99.3%

JSON

The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10 Gold and 1511, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka “Graphics Memory Corruption Vulnerability.”

CPENameOperatorVersion
microsoft:word_viewermicrosoft word viewereq-
microsoft:live_meetingmicrosoft live meetingeq2007
microsoft:lyncmicrosoft lynceq2010
microsoft:officemicrosoft officeeq2007
microsoft:officemicrosoft officeeq2010
microsoft:lyncmicrosoft lynceq2013
microsoft:skype_for_businessmicrosoft skype for businesseq2016
microsoft:windows_server_2008microsoft windows server 2008eqr2
microsoft:windows_server_2012microsoft windows server 2012eqr2
microsoft:windows_rtmicrosoft windows rteq-

CPE	Name	Operator	Version
microsoft:word_viewer	microsoft word viewer	eq	-
microsoft:live_meeting	microsoft live meeting	eq	2007
microsoft:lync	microsoft lync	eq	2010
microsoft:office	microsoft office	eq	2007
microsoft:office	microsoft office	eq	2010
microsoft:lync	microsoft lync	eq	2013
microsoft:skype_for_business	microsoft skype for business	eq	2016
microsoft:windows_server_2008	microsoft windows server 2008	eq	r2
microsoft:windows_server_2012	microsoft windows server 2012	eq	r2
microsoft:windows_rt	microsoft windows rt	eq	-