CVE-2015-1670: Infoleak

Published May 13, 2015

Updated

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."

Affected Software

7 affected components

Microsoft .NET Framework=3.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Microsoft .NET Framework=4.5.1

Microsoft .NET Framework=4.5.2

Event History

May 13, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1670?

CVE-2015-1670 is classified as a moderate severity vulnerability.

How can I fix CVE-2015-1670?

To fix CVE-2015-1670, update the Microsoft .NET Framework to a version that is not affected by this vulnerability.

What applications are affected by CVE-2015-1670?

CVE-2015-1670 affects various versions of Microsoft .NET Framework including 3.0 SP2, 3.5, 3.5.1, 4.0, 4.5, 4.5.1, and 4.5.2.

What type of attack does CVE-2015-1670 allow?

CVE-2015-1670 allows remote attackers to obtain sensitive information from process memory via crafted OpenType fonts.

How does CVE-2015-1670 affect security?

CVE-2015-1670 can lead to exposure of sensitive information, potentially allowing unauthorized access to confidential data.