CVE-2015-1670

The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."

Score

CVSS 2.0 4.3 Medium

Status

Modified - secure@microsoft.com

Published

2015-05-13

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• .net Framework (Microsoft)

References

• http://www.securityfocus.com/bid/74485
• http://www.securitytracker.com/id/1032281
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-044