CVE-2015-2460 — HIGH (9.3) — White Hats Nepal

Vulnerability Description

ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."

CVSS Score

9.3

HIGH

AV:N/AC:M/Au:N/C:C/I:C/A:C

Confidentiality

COMPLETE

Integrity

COMPLETE

Availability

COMPLETE

Affected Products

Vendor	Product	Versions
Microsoft	.Net Framework	3.5
Microsoft	Windows 10	-
Microsoft	Windows 8	-
Microsoft	Windows 8.1	-
Microsoft	Windows Server 2012	-
Microsoft	Windows 7	-
Microsoft	Windows Server 2008	r2
Microsoft	Windows Vista	-

Related Weaknesses (CWE)

CWE-20

References

http://www.securitytracker.com/id/1033238Third Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-08PatchVendor Advisory
https://www.exploit-db.com/exploits/37921/ExploitThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1033238Third Party AdvisoryVDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-08PatchVendor Advisory
https://www.exploit-db.com/exploits/37921/ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2015-2460?

CVE-2015-2460 is a vulnerability with a CVSS score of 9.3 (HIGH). ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows ...

How severe is CVE-2015-2460?

CVE-2015-2460 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-2460?

Check the references section above for vendor advisories and patch information. Affected products include: Microsoft .Net Framework, Microsoft Windows 10, Microsoft Windows 8, Microsoft Windows 8.1, Microsoft Windows Server 2012.