« Volver al listado

CVE-2015-6106

Estado: ModificadaAlta (9.3)—

The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (7)

Microsoft — Live MeetingMicrosoft — LyncMicrosoft — OfficeMicrosoft — Skype FOR BusinessMicrosoft — Windows Server 2008Microsoft — Windows VistaMicrosoft — Word Viewer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-6106",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-12-09T11:59:03.467",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1034331",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034332",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034333",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034336",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-128",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034331",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034332",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034333",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034336",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-128",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka \"Graphics Memory Corruption Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "La librería font de Windows en Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013 SP1 y Live Meeting 2007 Console permite a atacantes remotos ejecutar código arbitrario a través de una fuente embebida manipulada, también conocida como 'Graphics Memory Corruption Vulnerability'."
    }
  ],
  "lastModified": "2026-06-17T00:30:24.123",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0BB045C-AAC8-42F2-84A9-062630FA14E9"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF2C62AD-CC37-42B4-88AD-75F8F603ADEB"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2010:*:x86:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F01B787D-6263-4753-977D-211432447E38"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B854E18-7CB0-43F7-9EBF-E356FA176B2F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEECD12A-5BEF-4675-B62E-86CF4A7474D7"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69998A67-CB15-4217-8AD6-43F9BA3C6454"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x86:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "349E9084-8116-43E9-8B19-CA521C96660D"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D499807D-91F3-447D-B9F0-D612898C9339"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D79B6572-E7DF-4CC2-B70B-9B31BE1B6A81"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF1AD1A1-EE20-4BCE-9EE6-84B27139811C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}