CVE-2015-6107: Buffer Overflow
First published: Wed Dec 09 2015(Updated: )
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10 Gold and 1511, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Live Meeting | =2007 | |
| Microsoft Lync | =2010 | |
| Microsoft Lync | =2013-sp1 | |
| Microsoft Office | =2007-sp3 | |
| Microsoft Office | =2010-sp2 | |
| Microsoft Skype for Business | =2016 | |
| Microsoft Word Viewer | ||
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | =1511 | |
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows 8.0 | ||
| Microsoft Windows 8.1 | ||
| Microsoft Windows RT | ||
| Microsoft Windows RT | ||
| Microsoft Windows Server 2008 Itanium | =sp2 | |
| Microsoft Windows Server 2008 Itanium | =r2-sp1 | |
| Microsoft Windows Server 2008 Itanium | =r2-sp1 | |
| Microsoft Windows Server 2012 x64 | ||
| Microsoft Windows Server 2012 x64 | =r2 | |
| Microsoft Windows Vista | =sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-6107?
CVE-2015-6107 has a critical severity rating due to potential remote code execution via crafted font files.
How do I fix CVE-2015-6107?
To fix CVE-2015-6107, apply the latest security updates released by Microsoft for the affected software products.
Which software is affected by CVE-2015-6107?
CVE-2015-6107 affects various Microsoft products, including Windows Vista, Windows 7, Windows 8, Windows 10, and several versions of Microsoft Office.
Can CVE-2015-6107 be exploited remotely?
Yes, CVE-2015-6107 can be exploited remotely if a user opens a malicious document containing a specially crafted font.
What types of attacks can CVE-2015-6107 facilitate?
CVE-2015-6107 can facilitate remote code execution attacks, allowing attackers to take control of affected systems.
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft live meeting
- version/microsoft live meeting/2007
- canonical/microsoft lync
- version/microsoft lync/2010
- version/microsoft lync/2013-sp1
- canonical/microsoft office
- version/microsoft office/2007-sp3
- version/microsoft office/2010-sp2
- canonical/microsoft skype for business
- version/microsoft skype for business/2016
- canonical/microsoft word viewer
- canonical/microsoft windows 10
- version/microsoft windows 10/1511
- canonical/microsoft windows 7
- version/microsoft windows 7/sp1
- canonical/microsoft windows 8.0
- canonical/microsoft windows 8.1
- canonical/microsoft windows rt
- canonical/microsoft windows server 2008 itanium
- version/microsoft windows server 2008 itanium/sp2
- version/microsoft windows server 2008 itanium/r2-sp1
- canonical/microsoft windows server 2012 x64
- version/microsoft windows server 2012 x64/r2
- canonical/microsoft windows vista
- version/microsoft windows vista/sp2