Design/Logic Flaw

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."...

Denial of service

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service recursion and performance degradation via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."...

Spoofing

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5...

Privilege escalation

The Windows Forms aka WinForms libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability."...

CVE-2015-1673

CVE-2015-1673 affects the Windows Forms (WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2. It is described as a memory-handling vulnerability in WinForms that, when a crafted partial-trust application is used, allows a user-assisted remote att...

CVE-2015-1671

Summary: CVE-2015-1671 covers a remote code execution vulnerability in the Windows DirectWrite font parsing path used by multiple Microsoft products (Windows fonts stack, .NET Framework components, Office Lync/Live Meeting, Silverlight). The issue arises from handling of crafted TrueType fonts, e...

CVE-2015-1673

The Windows Forms aka WinForms libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability."...

CVE-2015-1670

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."...

CVE-2015-1670

CVE-2015-1670 is a memory-disclosure vulnerability in the Windows DirectWrite/OPENType pipeline (DirectWrite, and also affecting WPF). The root cause is uninitialized transient memory in the Charstring/interpreter path used by OpenType fonts, which allows leaking 1024 bits (32 entries of 32 bits)...

CVE-2015-1672

The CVE refers to a DoS vulnerability in Microsoft .NET Framework caused by improper handling of XML encrypted data. A remote attacker can trigger recursion during XML decryption, leading to performance degradation or denial of service. Affected products include .NET Framework 2.0 SP2, 3.5, 3.5.1...

CVE-2015-1671

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5...

CVE-2015-1671

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5...

CVE-2015-1673: Undefined Security Weakness

The Windows Forms aka WinForms libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability."...

CVE-2015-1671: Undefined Security Weakness

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5...

CVE-2015-1672: Undefined Security Weakness

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service recursion and performance degradation via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."...

CVE-2015-1670: Exposure of Sensitive Information to an Unauthorized Actor

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."...

Microsoft .NET Framework Privilege Elevation Vulnerability (3057134)

This host is missing an important security update according to Microsoft Bulletin MS15-048. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

PT-2015-5416

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.2 Description The issue is caused by the improper handling of objects in memory by the Windows Forms WinForms libraries in Microsoft .NET Framework. This allows an attacker to potentially...

MS15-048: Vulnerabilities in the .NET Framework could allow elevation of privilege: May 12, 2015

This update resolves vulnerabilities in the Microsoft .NET Framework that include vulnerabilities that could allow elevation of privilege if an attacker sends specially crafted data to a WinForms application that is running in partial trust, and vulnerabilities that could allow denial of service...

PT-2015-5414

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 3.0 SP2 through 4.5.2 Description An information disclosure issue exists in Microsoft Windows due to the improper handling of OpenType fonts by the Windows DirectWrite library. This allows an attacker to...