SB2019111219 - Remote code execution in Windows Adobe Type Manager Library

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-1419)

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Windows Adobe Type Manager Library handles specially crafted OpenType fonts. A remote attacker can create a specially crafted web page or document with embedded malicious font, trick the victim into opening it and execute arbitrary code on the system with privileges of the current user.

2) Input validation error (CVE-ID: CVE-2019-1456)

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Windows Adobe Type Manager Library handles specially crafted OpenType fonts. A remote attacker can create a specially crafted web page or document with embedded malicious font, trick the victim into opening it and execute arbitrary code on the system with privileges of the current user.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1419
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1456