CVE-2015-1671 The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attend...
HighCVSS 9.3
EPSS 48.8%
CISA KEV
added 2022-05-25 · due 2022-06-15
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
CISA Known Exploited Vulnerability
- Date added
- 2022-05-25
- Due date (FCEB)
- 2022-06-15
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft net framework | = 3.0-sp2 | No fix listed |
| Microsoft net framework | = 4.0 | No fix listed |
| Microsoft net framework | = 4.5 | No fix listed |
| Microsoft net framework | = 4.5.1 | No fix listed |
| Microsoft net framework | = 4.5.2 | No fix listed |
| Microsoft net framework | = 3.5.1 | No fix listed |
| Microsoft net framework | = 3.5 | No fix listed |
| Microsoft live meeting | = 2007 | No fix listed |
| Microsoft lync | = 2010 | No fix listed |
| Microsoft lync | = 2013-sp1 | No fix listed |
| Microsoft silverlight | = 5.0 | No fix listed |
References
- 74490 broken-link third-party-advisory vdb-entry
- 1032281 broken-link third-party-advisory vdb-entry
- MS15-044 patch vendor-advisory
- www.cisa.gov government-resource us-government-resource