CVE-2015-1671
CVE-2015-1671
In short
A flaw in Windows DirectWrite library allows attackers to run malicious code on your computer by sending a specially crafted TrueType font file. This affects multiple Microsoft applications and can compromise your system if you open an untrusted font.
Technical detail
Remote code execution vulnerability in DirectWrite's TrueType font parsing routine, exploitable via specially crafted font files delivered through various Microsoft products (.NET Framework, Office, Lync, Silverlight). Attack requires user interaction to open/process the malicious font; successful exploitation grants arbitrary code execution in the context of the affected application.
Summary generated and translated by AI from the official description.
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →