CVE-2011-0033 The OpenType Compact Font Format (CFF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not pro...
HighCVSS 9.3
EPSS 20.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The OpenType Compact Font Format (CFF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate parameter values in OpenType fonts, which allows remote attackers to execute arbitrary code via a crafted font, aka "OpenType Font Encoded Character Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2003 server | All versions | No fix listed |
| Microsoft windows 7 | All versions | No fix listed |
| Microsoft windows server 2003 | All versions | No fix listed |
| Microsoft windows server 2008 | All versions | No fix listed |
| Microsoft windows vista | All versions | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 70821 vdb-entry
- 43252 third-party-advisory vendor-advisory
- support.avaya.com
- 46106 vdb-entry
- 1025034 vdb-entry
- ADV-2011-0320 vdb-entry vendor-advisory
- MS11-007 vendor-advisory
- ms-opentype-cff-code-execution(64906) vdb-entry
- oval:org.mitre.oval:def:11593 signature vdb-entry