CVE-2016-3303
published 2016-08-09CVE-2016-3303: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer…
PriorityP266high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
50.51%
98.8th percentile
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3304.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | live_meeting | — | — |
| microsoft | lync | — | — |
| microsoft | lync | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | skype_for_business | — | — |
| microsoft | windows_server_2008 | — | — |
| msrc | microsoft_live_meeting_2007_console | — | — |
| msrc | microsoft_lync_2010 | — | — |
| msrc | microsoft_lync_2010_attendee | — | — |
| msrc | microsoft_lync_2013_service_pack_1 | — | — |
| msrc | microsoft_lync_basic_2013_service_pack_1 | — | — |
| msrc | microsoft_office_2007_service_pack_3 | — | — |
| msrc | microsoft_office_2010_service_pack_2 | — | — |
| msrc | microsoft_office_word_viewer | — | — |
| msrc | skype | — | — |
| msrc | windows_7 | — | — |
| msrc | windows_server_2008 | — | — |
| msrc | windows_server_2008_r2 | — | — |
| msrc | windows_vista_service_pack_2 | — | — |
| msrc | windows_vista_x64_edition_service_pack_2 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
pathC:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23407_none_5c02a2f5a011f9be\GdiPlus.dll↗
- →Look for EMF files containing EMR_PLGBLT records with malformed embedded bitmaps where biWidth=0x30000000, biHeight=0x00000002, biPlanes=0x0001, biBitCount=0x0008 — the specific field combination used in the PoC to trigger the out-of-bounds read. ↗
- →Detect EMF files embedding bitmaps in records EMR_PLGBLT, EMR_BITBLT, EMR_STRETCHBLT, EMR_STRETCHDIBITS with a biWidth value that causes bytes_per_row_signed to be negative (e.g. very large biWidth such that biWidth * stride overflows to negative), combined with biHeight > 1, which causes gdiplus!ValidateBitmapInfo to compute an out-of-bounds first_row pointer. ↗
- →Flag EMF files where GetDibBitsSize() would return 0 for the embedded bitmap header — this bypasses the record-length bounds check in gdiplus!GetBitmapFromRecord and is a prerequisite for exploitation. ↗
- ·The PoC and crash analysis were performed against gdiplus.dll version 1.1.7601.23407 on a fully patched Windows 7 64-bit system; the vulnerable code path may differ in layout or offset on other Windows versions covered by MS16-097. ↗
- ·The exploit-db entry (40256) covers the related CVE-2016-3304 / MS16-097 GDI+ ValidateBitmapInfo bug; the NVD source notes CVE-2016-3303 and CVE-2016-3304 are distinct vulnerabilities ('a different vulnerability than CVE-2016-3303') sharing the same advisory and patch. ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4qmp-55x3-xph5: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Vie
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2016-3303 [HIGH] CWE-20 GHSA-4qmp-55x3-xph5: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Vie
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3304.
GHSA
GHSA-564g-g3h9-2h5g: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Vie
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2016-3304 [HIGH] CWE-20 GHSA-564g-g3h9-2h5g: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Vie
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3303.
Microsoft
Microsoft Graphics Remote Code Execution Vulnerability
vendor_msrc·2016-08-09·CVSS 8.8
CVE-2016-3303 [HIGH] Microsoft Graphics Remote Code Execution Vulnerability
Microsoft Graphics Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
There are multiple ways an attacker could exploit the vulnerability:
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view
No detection rules found.
Talos
Microsoft Patch Tuesday - August 2016
blogs_talos·2016-08-09·CVSS 7.8
[HIGH] Microsoft Patch Tuesday - August 2016
This post was authored by Edmund Brumaghin and Jonah Samost
Today is Patch Tuesday for August 2016, and Microsoft has released several security bulletins and associated patches to resolve security issues across their products. This month’s patch release includes 9 bulletins addressing 28 vulnerabilities. Five of the bulletins Microsoft has released are rated Critical and address vulnerabilities in Internet Explorer, Edge, Windows Graphics Component, Microsoft Office, and the Windows PDF library. The remaining four bulletins are rated Important and address vulnerabilities in Windows Kernel-Mode Drivers, Secure Boot, Windows Authentication Methods, and ActiveSyncProvider.
## Bulletins Rated CriticalMicrosoft has listed bulletins MS16-095, MS16-096, MS16-097, MS16-099, MS16-102 as critical
Talos
Microsoft Patch Tuesday - August 2016
blogs_talos·2016-08-09·CVSS 7.8
[HIGH] Microsoft Patch Tuesday - August 2016
## Microsoft Patch Tuesday - August 2016
This post was authored by Edmund Brumaghin and Jonah Samost
Today is Patch Tuesday for August 2016, and Microsoft has released several security bulletins and associated patches to resolve security issues across their products. This month’s patch release includes 9 bulletins addressing 28 vulnerabilities. Five of the bulletins Microsoft has released are rated Critical and address vulnerabilities in Internet Explorer, Edge, Windows Graphics Component, Microsoft Office, and the Windows PDF library. The remaining four bulletins are rated Important and address vulnerabilities in Windows Kernel-Mode Drivers, Secure Boot, Windows Authentication Methods, and ActiveSyncProvider.
## Bulletins Rated Critical Microsoft has listed bulletins MS16-095, MS16-096
http://www.securityfocus.com/bid/92301http://www.securitytracker.com/id/1036564https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097https://www.exploit-db.com/exploits/40256/http://www.securityfocus.com/bid/92301http://www.securitytracker.com/id/1036564https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097https://www.exploit-db.com/exploits/40256/
2016-08-09
Published