CVE-2015-2463

CVE-2015-2463/2464 describe a TrueType font parsing vulnerability affecting multiple Windows variants (Vista SP2, 7 SP1, 8/8.1, Server 2008/2012, RT, Office 2007/2010, Silverlight, .NET Framework). The issue allows remote code execution via a crafted TrueType font, caused by a parsing flaw in the...

CVE-2015-2461

ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted...

CVE-2015-2455

CVE-2015-2455 (TrueType Font Parsing Vulnerability) is a Windows font-processing defect discovered via Project Zero fuzzing of the Windows kernel font stack (win32k.sys and ATMFD.DLL) affecting TrueType fonts and related SFNT tables. The Google Project Zero report outlines that incorrect handling...

CVE-2015-2432

CVE-2015-2432 affects ATMFD.DLL in the Windows Adobe Type Manager Library, enabling remote code execution via crafted OpenType fonts. Affected products include Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 (and RT variants). The root cause is...

CVE-2015-2432

ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font...

Microsoft Windows TrueType Font Remote Code Execution Vulnerability (CNVD-2015-05351)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows TrueType, which can be exploited by an attacker to take full control of the affected system...

Microsoft Windows OpenType Font Remote Code Execution Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows OpenType, which can be exploited by an attacker to take full control of an affected system...

Microsoft Windows TrueType Font Remote Code Execution Vulnerability (CNVD-2015-05361)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows TrueType, which can be exploited by an attacker to take full control of the affected system...

Microsoft Windows OpenType Font Remote Code Execution Vulnerability (CNVD-2015-05362)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows OpenType, which can be exploited by an attacker to take full control of an affected system...

Microsoft Windows OpenType Font Remote Code Execution Vulnerability (CNVD-2015-05365)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows OpenType, which can be exploited by an attacker to take full control of an affected system...

Microsoft Windows OpenType Font Remote Code Execution Vulnerability (CNVD-2015-05364)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows OpenType, which can be exploited by an attacker to take full control of an affected system...

Microsoft Windows OpenType Font Remote Code Execution Vulnerability (CNVD-2015-05363)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows OpenType, which can be exploited by an attacker to take full control of an affected system...

Microsoft Windows TrueType Font Remote Code Execution Vulnerability (CNVD-2015-05352)

Microsoft Windows is a series of operating systems released by the American company Microsoft. A font remote code execution vulnerability exists in Microsoft Windows TrueType, which can be exploited by an attacker to take full control of the affected system...

One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation

Posted by Mateusz Jurczyk of Google Project Zero This is part 3 of the “One font vulnerability to rule them all” blog post series. In the previous posts, we introduced the “blend” PostScript operator vulnerability, discussed the Charstring primitives necessary to fully control the stack contents...

Microsoft Office Open Graphic Font Remote Code Execution Vulnerability

Microsoft Office is a Windows-based office software suite developed by Microsoft. Commonly used components are Word, Excel, Powerpoint and so on. A remote code execution vulnerability exists in the Microsoft Office Open Graphic font. Allows an attacker to execute arbitrary code in the context of ...

Microsoft Office Font Drivers Remote Code Execution Vulnerability (3078662)

This host is missing a critical security update according to Microsoft Bulletin MS15-080. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

(Pwn2Own) Microsoft Windows TrueType Font Pool Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing...

Microsoft Windows OpenType Font Parsing Remote Code Execution (MS15-080: CVE-2015-2460)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way the OpenType Font OTF driver handles objects in memory. A remote attacker can exploit this issue by enticing a target user to open a specially crafted web page or email...

Microsoft Windows OpenType Font Parsing Remote Code Execution (MS15-080: CVE-2015-2459)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way the OpenType Font OTF driver handles objects in memory. A remote attacker can exploit this issue by enticing a target user to open a specially crafted .otf file or web pag...

One font vulnerability to rule them all #2: Adobe Reader RCE exploitation

Posted by Mateusz Jurczyk of Google Project Zero This is part 2 of the “One font vulnerability to rule them all” blog post series. In part 1 “introducing the BLEND vulnerability”, we discussed how developments in the digital typography field in the last four decades shaped the various font format...