SB2018021314 - Information disclosure in Windows EOT Font Engine
Published: February 13, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2018-0855)
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts. A local attacker can gain access to potentially sensitive information.
2) Information disclosure (CVE-ID: CVE-2018-0755)
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts.. A local attacker can open a specially crafted document, containing malicious OpenType font and gain access to potentially sensitive information.
3) Information disclosure (CVE-ID: CVE-2018-0760)
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts.. A local attacker can open a specially crafted document, containing malicious OpenType font and gain access to potentially sensitive information.
4) Information disclosure (CVE-ID: CVE-2018-0761)
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts.. A local attacker can open a specially crafted document, containing malicious OpenType font and gain access to potentially sensitive information.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0855
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0755
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0760
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0761