CVEvulnerability
CVE-2015-1670
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-05-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."
Affected configurations
• microsoft .net framework 3.0
• microsoft .net framework 3.5
• microsoft .net framework 3.5.1
• microsoft .net framework 4.0
• microsoft .net framework 4.5
• microsoft .net framework 4.5.1
• microsoft .net framework 4.5.2
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.securityfocus.com/bid/74485 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032281 Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 docs.microsoft.com
- http://www.securityfocus.com/bid/74485 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032281 Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044 docs.microsoft.com