CVE-2015-6130 - Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remo

CVE-2015-6130

Summary

Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code via a crafted font, aka "Windows Integer Underflow Vulnerability."

References

Vulnerable Configurations

cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 12-10-2018 - 22:10)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

msbulletin via4

bulletin_id	MS15-130
bulletin_url
date	2015-12-08T00:00:00
impact	Remote Code Execution
knowledgebase_id	3108670
knowledgebase_url
severity	Critical
title	Security Update for Microsoft Uniscribe to Address Remote Code Execution

refmap via4

misc	http://blogs.flexerasoftware.com/secunia-research/2015/12/vulnerability-in-microsofts-unicode-scripts-processor-allows-execution-of-arbitrary-code.html
sectrack	1034337

Last major update

12-10-2018 - 22:10

Published

09-12-2015 - 11:59

Last modified

12-10-2018 - 22:10