1. CVE-Search
  2. CVE-2012-0159
ID CVE-2012-0159
Summary Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview; Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Silverlight 4 before 4.1.10329; and Silverlight 5 before 5.1.10411 allow remote attackers to execute arbitrary code via a crafted TrueType font (TTF) file, aka "TrueType Font Parsing Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2010:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office:2010:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8:consumer_preview:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_8:consumer_preview:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.50401.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.50401.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.50524.00:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.50524.00:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.50826.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.50826.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.50917.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.50917.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.51204.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.51204.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.60129.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.60129.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.60310.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.60310.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.60531.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.60531.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.0.60831.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.0.60831.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:4.1.10111.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:4.1.10111.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:5.0.60401.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:5.0.60401.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:5.0.60818.0:rc:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:5.0.60818.0:rc:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:silverlight:5.0.61118.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:silverlight:5.0.61118.0:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 12-10-2018 - 22:02)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
msbulletin via4
bulletin_id MS12-034
bulletin_url
date 2012-05-08T00:00:00
impact Remote Code Execution
knowledgebase_id 2681578
knowledgebase_url
severity Critical
title Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight
oval via4
  • accepted 2015-08-10T04:00:18.274-04:00
    class vulnerability
    contributors
    • name Dragos Prisaca
      organization Symantec Corporation
    • name Josh Turpin
      organization Symantec Corporation
    • name Sergey Artykhov
      organization ALTX-SOFT
    • name Shane Shaffer
      organization G2, Inc.
    • name Sharath S
      organization SecPod Technologies
    • name Maria Kedovskaya
      organization ALTX-SOFT
    • name Maria Kedovskaya
      organization ALTX-SOFT
    • name Maria Kedovskaya
      organization ALTX-SOFT
    • name Maria Kedovskaya
      organization ALTX-SOFT
    • name Maria Mikhno
      organization ALTX-SOFT
    • name Maria Mikhno
      organization ALTX-SOFT
    • name Maria Mikhno
      organization ALTX-SOFT
    • name Maria Mikhno
      organization ALTX-SOFT
    • name Maria Mikhno
      organization ALTX-SOFT
    • name Maria Mikhno
      organization ALTX-SOFT
    definition_extensions
    • comment Microsoft Windows Vista (32-bit) Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6124
    • comment Microsoft Windows Vista x64 Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:5594
    • comment Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed
      oval oval:org.mitre.oval:def:5653
    • comment Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6216
    • comment Microsoft Windows 7 (32-bit) is installed
      oval oval:org.mitre.oval:def:6165
    • comment Microsoft Windows 7 x64 Edition is installed
      oval oval:org.mitre.oval:def:5950
    • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
      oval oval:org.mitre.oval:def:6438
    • comment Microsoft Windows 7 (32-bit) Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12292
    • comment Microsoft Windows 7 x64 Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12627
    • comment Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12567
    • comment Microsoft Windows XP (x86) SP3 is installed
      oval oval:org.mitre.oval:def:5631
    • comment Microsoft Windows XP x64 Edition SP2 is installed
      oval oval:org.mitre.oval:def:4193
    • comment Microsoft Windows Server 2003 SP2 (x86) is installed
      oval oval:org.mitre.oval:def:1935
    • comment Microsoft Windows Server 2003 SP2 (x64) is installed
      oval oval:org.mitre.oval:def:2161
    • comment Microsoft Windows Server 2003 (ia64) SP2 is installed
      oval oval:org.mitre.oval:def:1442
    • comment Microsoft Windows Vista (32-bit) Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6124
    • comment Microsoft Windows Vista x64 Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:5594
    • comment Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed
      oval oval:org.mitre.oval:def:5653
    • comment Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6216
    • comment Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6150
    • comment Microsoft Windows 7 (32-bit) is installed
      oval oval:org.mitre.oval:def:6165
    • comment Microsoft Windows 7 x64 Edition is installed
      oval oval:org.mitre.oval:def:5950
    • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
      oval oval:org.mitre.oval:def:6438
    • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
      oval oval:org.mitre.oval:def:5954
    • comment Microsoft Windows 7 (32-bit) Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12292
    • comment Microsoft Windows 7 x64 Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12627
    • comment Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12567
    • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12583
    • comment Microsoft Windows XP (x86) SP3 is installed
      oval oval:org.mitre.oval:def:5631
    • comment Microsoft Windows XP x64 Edition SP2 is installed
      oval oval:org.mitre.oval:def:4193
    • comment Microsoft Windows Server 2003 SP2 (x64) is installed
      oval oval:org.mitre.oval:def:2161
    • comment Microsoft Windows Server 2003 SP2 (x86) is installed
      oval oval:org.mitre.oval:def:1935
    • comment Microsoft Windows Server 2003 (ia64) SP2 is installed
      oval oval:org.mitre.oval:def:1442
    • comment Microsoft Windows Vista (32-bit) Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6124
    • comment Microsoft Windows Vista x64 Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:5594
    • comment Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed
      oval oval:org.mitre.oval:def:5653
    • comment Microsoft Windows Server 2008 x64 Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6216
    • comment Microsoft Windows Server 2008 Itanium-Based Edition Service Pack 2 is installed
      oval oval:org.mitre.oval:def:6150
    • comment Microsoft Windows 7 (32-bit) is installed
      oval oval:org.mitre.oval:def:6165
    • comment Microsoft Windows 7 x64 Edition is installed
      oval oval:org.mitre.oval:def:5950
    • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
      oval oval:org.mitre.oval:def:6438
    • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
      oval oval:org.mitre.oval:def:5954
    • comment Microsoft Windows 7 (32-bit) Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12292
    • comment Microsoft Windows 7 x64 Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12627
    • comment Microsoft Windows Server 2008 R2 x64 Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12567
    • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition Service Pack 1 is installed
      oval oval:org.mitre.oval:def:12583
    • comment Microsoft Windows XP (x86) SP3 is installed
      oval oval:org.mitre.oval:def:5631
    • comment Microsoft Windows XP x64 Edition SP2 is installed
      oval oval:org.mitre.oval:def:4193
    • comment Microsoft Windows Server 2003 SP2 (x86) is installed
      oval oval:org.mitre.oval:def:1935
    • comment Microsoft Windows Server 2003 SP2 (x64) is installed
      oval oval:org.mitre.oval:def:2161
    • comment Microsoft Windows Server 2003 (ia64) SP2 is installed
      oval oval:org.mitre.oval:def:1442
    • comment Microsoft Silverlight 4 is installed
      oval oval:org.mitre.oval:def:14639
    • comment Microsoft Silverlight 5 is installed
      oval oval:org.mitre.oval:def:15148
    • comment Microsoft Office 2003 is installed
      oval oval:org.mitre.oval:def:233
    • comment Microsoft Office 2007 is installed
      oval oval:org.mitre.oval:def:1211
    • comment Microsoft Office 2010 is installed
      oval oval:org.mitre.oval:def:12061
    description Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview; Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Silverlight 4 before 4.1.10329; and Silverlight 5 before 5.1.10411 allow remote attackers to execute arbitrary code via a crafted TrueType font (TTF) file, aka "TrueType Font Parsing Vulnerability."
    family windows
    id oval:org.mitre.oval:def:15388
    status accepted
    submitted 2012-05-08T13:00:00
    title TrueType Font Parsing Vulnerability (CVE-2012-0159)
    version 112
  • accepted 2014-08-18T04:01:22.478-04:00
    class vulnerability
    contributors
    • name SecPod Team
      organization SecPod Technologies
    • name Evgeniy Pavlov
      organization ALTX-SOFT
    definition_extensions
    • comment Microsoft Lync 2010 is installed
      oval oval:org.mitre.oval:def:15099
    • comment Microsoft Lync 2010 Attendee (user level install) is installed
      oval oval:org.mitre.oval:def:15641
    • comment Microsoft Lync 2010 Attendee (admin level install) is installed
      oval oval:org.mitre.oval:def:15556
    description Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview; Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Silverlight 4 before 4.1.10329; and Silverlight 5 before 5.1.10411 allow remote attackers to execute arbitrary code via a crafted TrueType font (TTF) file, aka "TrueType Font Parsing Vulnerability."
    family windows
    id oval:org.mitre.oval:def:15667
    status accepted
    submitted 2012-06-18T15:13:15
    title TrueType Font Parsing Vulnerability (CVE-2012-0159)
    version 13
refmap via4
bid 53335
cert
  • TA12-129A
  • TA12-164A
sectrack 1027039
secunia
  • 49121
  • 49122
xf microsoft-truetype-code-exec(75124)
Last major update 12-10-2018 - 22:02
Published 09-05-2012 - 00:55
Last modified 12-10-2018 - 22:02
Back to Top