CVSS: 10.0EPSS: 13%CPEs: 37EXPL: 1CVE-2015-2455 – Microsoft Windows TrueType Fonts Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-2455
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2456. Vulnerabilidad en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT Gold y 8.1, Windows 10, Office 2007 SP3 y 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight en versiones anteriores a 5.1.40728 y .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2 y 4.6, permite a atacantes remotos ejecutar código arbitrario a través de fuente TrueType manipulada, también conocida como 'TrueType Font Parsing Vulnerability', una vulnerabilidad diferente a CVE-2015-2456. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of the IUP instruction (opcode 0x31) in TrueType fonts. A crafted font can cause point patching to modify arbitrary addresses in the Windows kernel. • https://www.exploit-db.com/exploits/37919 http://www.securityfocus.com/bid/76216 http://www.securitytracker.com/id/1033238 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 68%CPEs: 7EXPL: 0CVE-2015-2380
https://notcve.org/view.php?id=CVE-2015-2380
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, y Word 2013 RT SP1 permite a atacantes remotos la ejecución de código arbitrario o provocar denegación de servicio (corrupción de memoria) vía documento de Office modificado, también conocido como 'Vulnerabilidad de corrupción de Memoria en Microsoft Office'. • http://www.securitytracker.com/id/1032899 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.9EPSS: 58%CPEs: 5EXPL: 0CVE-2015-2378
https://notcve.org/view.php?id=CVE-2015-2378
Untrusted search path vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Microsoft Excel DLL Remote Code Execution Vulnerability." Vulnerabilidad de búsqueda no fiable de ruta en Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, y Office Compatibility Pack SP3 que permite a usuarios locales escalar privilegios, a través de un troyano DLL, en el directorio de trabajo actual, también conocida como “Vulnerabilidad de Ejecución de código Remota DLL en Microsoft Excel.” • http://www.securitytracker.com/id/1032899 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070 •
CVSS: 9.3EPSS: 40%CPEs: 7EXPL: 0CVE-2015-2379
https://notcve.org/view.php?id=CVE-2015-2379
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office para Mac 2011, y Word Viewer permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un documento Office manipulado, también conocida como “Vulnerabilidad de corrupción de Memoria en Microsoft Office.” • http://www.securitytracker.com/id/1032899 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 68%CPEs: 6EXPL: 0CVE-2015-2415
https://notcve.org/view.php?id=CVE-2015-2415
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, y Office Compatibility Pack SP3 permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un documento Office manipulado, también conocida como “Vulnerabilidad de corrupción de Memoria en Microsoft Office.” • http://www.securitytracker.com/id/1032899 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •