Vulners
Lucene search
Microsoft Windows - 'LoadUvsTable()' Heap Buffer Overflow
| Reporter | Title | Published | Views | Family All 33 |
|---|---|---|---|---|
 | Microsoft Windows - LoadUvsTable() Heap-based Buffer Overflow Vulnerability | 16 Mar 201700:00 | – | zdt |
 | Microsoft Windows Uniscribe Component Remote Code Execution Vulnerability | 14 Dec 201600:00 | – | cnvd |
 | Microsoft Windows Uniscribe Remote Code Execution (MS16-147: CVE-2016-7274) | 13 Dec 201600:00 | – | checkpoint_advisories |
 | CVE-2016-7274 | 20 Dec 201605:54 | – | cve |
 | CVE-2016-7274 | 20 Dec 201605:54 | – | cvelist |
 | Microsoft Windows - LoadUvsTable() Heap Buffer Overflow | 15 Mar 201700:00 | – | exploitpack |
 | Notes on Windows Uniscribe Fuzzing | 10 Apr 201700:00 | – | googleprojectzero |
 | Security update 2016-12-13 | 13 Dec 201608:00 | – | mskb |
| MS16-148: Description of the security update for Office 2010: December 13, 2016 | 13 Dec 201608:00 | – | mskb |
| Security update 2016-12-13 | 13 Dec 201608:00 | – | mskb |
10
# Date: 15-03-2017
# Author: Hossein Lotfi (https://twitter.com/hosselot)
# CVE: CVE-2016-7274
1. Description
An integer overflow error within the "LoadUvsTable()" function of usp10.dll
can be exploited to cause a heap-based buffer overflow. Full analysis is
available at:
http://blogs.flexerasoftware.com/secunia-research/2016/12/microsoft_windows_loaduvstable_heap_based_buffer_overflow_vulnerability.html
2. Proof of Concept
open “C:\Windows\Fonts\phagspa.ttf” in a hex editor and change the value at
offset 0x2051 from 0x00000006 to 0x33333334.
3. Solution:
Microsoft initially tried to fixed the issue in MS16-147, but the fix was
incomplete and the issue remained unpatched til Microsoft March 2017 patch
release:
https://twitter.com/hosselot/status/809059287037251584
It appears MS17-013 finally fixed the vulnerability properly:
https://technet.microsoft.com/en-us/library/security/ms17-013.aspx
@hosselotData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
15 Mar 2017 00:00Current
8.2High risk
Vulners AI Score8.2
CVSS 38.8
CVSS 29.3
EPSS0.38401