CVE-2016-3304 : The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2

The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3303.

Published 2016-08-09 21:59:14

Updated 2018-10-12 22:12:26

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Input validationExecute code

Products affected by CVE-2016-3304

Microsoft » Office » Version: 2007 Update SP3
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2010 Update SP2
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Word Viewer
cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Vista » Update SP2
cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Update SP2
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Windows 7 » Update SP1
cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Lync » Version: 2010 Attendee Edition
cpe:2.3:a:microsoft:lync:2010:*:attendee:*:*:*:*:*
Matching versions
Microsoft » Lync » Version: 2010
cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:*:*
Matching versions
Microsoft » Lync » Version: 2013 Update SP1
cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Live Meeting » Version: 2007
cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:*
Matching versions
Microsoft » Skype For Business » Version: 2016
cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2016-3304

Top countries where our scanners detected CVE-2016-3304

Top open port discovered on systems with this issue 443

IPs affected by CVE-2016-3304 1,395

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2016-3304!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2016-3304

EPSS FAQ

29.78%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-3304

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-3304

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-3304

http://www.securitytracker.com/id/1036564

Microsoft Graphics Component Flaws Let Remote Users Execute Arbitrary Code - SecurityTracker

CVEs referencing this url
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097

Microsoft Security Bulletin MS16-097 - Critical | Microsoft Docs

CVEs referencing this url
http://www.securityfocus.com/bid/92302

Microsoft Windows Graphics Component CVE-2016-3304 Remote Code Execution Vulnerability
https://www.exploit-db.com/exploits/40257/

Microsoft Windows - GDI+ EMR_EXTTEXTOUTA / EMR_POLYTEXTOUTA Heap Buffer Overflow (MS16-097)