CVE-2020-1436

Опубликовано: 14 июл. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Средний

Описание

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Windows Font Library Remote Code Execution Vulnerability'.

Ссылки

http://www.openwall.com/lists/oss-security/2020/08/25/3
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/08/25/5
Mailing List
Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1436
Patch
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-877/
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2020/08/25/3
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/08/25/5
Mailing List
Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1436
Patch
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-877/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.10033

Средний

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2020-1436

CVSS3: 6.3

msrc

почти 5 лет назад

Windows Font Library Remote Code Execution Vulnerability

GHSA-g587-x8m2-frwg

CVSS3: 8.8

github

около 3 лет назад

BDU:2020-03504

CVSS3: 8.8

fstec

почти 5 лет назад

Уязвимость библиотеки шрифтов операционных систем Windows, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 93%

0.10033

Средний

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787