CVE-2015-1671

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 49,0%

Kerentanan pada microsoft .net framework, microsoft live meeting +2 lainnya. Skor CVSS 3.1 7.8 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 25 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."

Rincian

Terbit di NVD

13 Mei 2015

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

49,0% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Windows Remote Code Execution Vulnerability

Masuk KEV

25 Mei 2022

Tenggat CISA

15 Juni 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1671 pemerintah AS
• http://www.securityfocus.com/bid/74490 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1032281 broken link · advisory pihak ketiga · vdb entry