Microsoft · Windows
CVE-2015-1671
Microsoft Windows Remote Code Execution Vulnerability
Qué es
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
CISA: A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 15 de junio de 2022
Más fallos explotados de Microsoft
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 13 oct 2026 | Command Injection | Windows | Alto 8,8 | 9,8% |
| 8 sept 2026 | Link Following | Windows | Alto 7,8 | 0,4% |
| 8 sept 2026 | Heap-Based Buffer Overflow | Windows | Alto 7,8 | 0,4% |
| 20 may 2026 | Buffer Overflow | Windows | Crítica 9,8 | 99% |
| 28 abr 2026 | Protection Mechanism Failure | Windows | Media 4,3 | 71% |
| 13 abr 2026 | Out-of-Bounds Read | Windows | Alto 7,8 | 12% |
| 13 abr 2026 | Link Following | Windows | Alto 7,8 | 4,6% |
| 17 feb 2026 | Microsoft Windows Video ActiveX Control Remote Code Execution | Windows | Alto 8,8 | 77% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.