CERT-In Vulnerability Note
CIVN-2015-0300
Multiple Vulnerabilities in Microsoft Graphics Component
Original Issue Date:December 09, 2015
Severity Rating: HIGH
Software Affected
- Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit and x64-based Systems Service Pack 2 (Server Core installation also affected)
- Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit and x64-based Systems Service Pack 1
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
- Windows 8 for 32-bit and x64-based Systems
- Windows 8.1 for 32-bit and x64-based Systems
- Windows Server 2012 and 2012 R2
- Windows RT and RT 8.1
- Windows 10 for 32-bit and x64-based Systems
- Windows 10 Version 1511 for 32-bit and x64-based Systems
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
- Windows Server 2012 and 2012 R2 (Server Core installation)
- Microsoft Office 2007 Service Pack 3
- Microsoft Office 2010 Service Pack 2 (32-bit and 64-bit editions)
- Microsoft Word Viewer
- Skype for Business 2016 (32-bit & 64-bit editions)
- Skype for Business Basic 2016 (32-bit & 64-bit editions)
- Microsoft Lync 2013 Service Pack 1 (32-bit & 64-bit)
- Microsoft Lync Basic 2013 Service Pack 1 (32-bit & 64-bit)
- Microsoft Lync 2010 (32-bit & 64-bit)
- Microsoft Live Meeting 2007 Console
- Microsoft Silverlight 5
- Microsoft Silverlight 5 Developer Runtime
- Microsoft .NET Framework 3.0 Service Pack 2
- Microsoft .NET Framework 3.5
- Microsoft .NET Framework 3.5.1
- Microsoft .NET Framework 4
- Microsoft .NET Framework 4.5/4.5.1/4.5.2
- Microsoft .NET Framework 4.6
Overview
Multiple vulnerabilities have been reported in Microsoft graphics component which could allow an unauthenticated, remote attacker to execute arbitrary code with privileges of the user.
Description
Multiple Memory Corruption Vulnerabilities
(
CVE-2015-6106
CVE-2015-6107
CVE-2015-6108
)
These vulnerabilities exist in Microsoft graphics component due to improper handling specially crafted embedded fonts of Windows font library. A remote attacker could exploit these vulnerabilities by enticing the user to visit a specially crafted web document that contains malicious embedded fonts. Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code with privileges of the user.
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS15-128
Vendor Information
Microsoft
https://technet.microsoft.com/en-us/library/security/ms15-128.aspx
References
Microsoft
https://technet.microsoft.com/en-us/library/security/ms15-128.aspx
Security Tracker
http://securitytracker.com/id/1034336
Security Focus
http://www.securityfocus.com/bid/78497
http://www.securityfocus.com/bid/78498
http://www.securityfocus.com/bid/78499
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=42393
http://tools.cisco.com/security/center/viewAlert.x?alertId=42394
http://tools.cisco.com/security/center/viewAlert.x?alertId=42395
CVE Name
CVE-2015-6106
CVE-2015-6107
CVE-2015-6108
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|