CVE-2015-2460 : ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,

ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."

Published 2015-08-15 00:59:20

Updated 2019-05-17 12:53:41

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Input validationExecute code

Exploit prediction scoring system (EPSS) score for CVE-2015-2460

EPSS FAQ

38.42%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-2460

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2015-2460

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-2460

http://www.securitytracker.com/id/1033238

Microsoft Graphics Component Bugs Let Remote Users Execute Arbitrary Code and Remote Authenticated Users Bypass Security Features and Gain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-080

Microsoft Security Bulletin MS15-080 - Critical | Microsoft Docs
Patch;Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/37921/

Microsoft Windows - 'ATMFD.dll' CFF table (ATMFD+0x3440b / ATMFD+0x3440e) Invalid Memory Access
Exploit;Third Party Advisory;VDB Entry

Products affected by CVE-2015-2460

Microsoft » .net Framework » Version: 3.5
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: N/A
When used together with: Microsoft » Windows 8 » Version: N/A
When used together with: Microsoft » Windows 8.1 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: N/A
When used together with: Microsoft » Windows Server 2012 » Version: R2
Microsoft » .net Framework » Version: 3.5.1
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1
When used together with: Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
Microsoft » .net Framework » Version: 4.0
cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 3.0 Update SP2
cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.5
cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.5.1
cpe:2.3:a:microsoft:.net_framework:4.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.5.2
cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
Microsoft » .net Framework » Version: 4.6
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2

Vulnerability Details : CVE-2015-2460

Exploit prediction scoring system (EPSS) score for CVE-2015-2460

CVSS scores for CVE-2015-2460

CWE ids for CVE-2015-2460

References for CVE-2015-2460

Products affected by CVE-2015-2460