CVE-2019-1419 — Microsoft Windows vulnerability

11 documents6 sources
Severity
8.8HIGHNVD
EPSS
23.7%
top 3.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+6 more
Timeline
PublishedNov 12
Latest updateMay 24

Description

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts, aka 'OpenType Font Parsing Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1456.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/windows18 versions+17
▶NVDmicrosoft/windowsr2, 1803, 1903+2
▶NVDmicrosoft/windows_105 versions+4
▶CVEListV5microsoft/windows_server17 versions+16

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-6fvv-v56q-722c: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2022-05-24
▶
GHSA
GHSA-j7vv-hfcm-2mq5: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2022-05-24
▶
CVEList
CVE-2019-1456: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2019-11-12
▶
CVEList
CVE-2019-1419: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2019-11-12
▶

📋Vendor Advisories

1
Microsoft
OpenType Font Parsing Remote Code Execution Vulnerability↗2019-11-12
▶

🕵️Threat Intelligence

2
Talos
Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage↗2019-11-12
▶
Talos
Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage↗2019-11-12
▶

💬Community

2
Bugzilla
CVE-2019-3872 picketlink: reflected XSS in SAMLRequest via RelayState parameter↗2019-03-14
▶
Bugzilla
CVE-2019-3873 picketlink: URL injection via xinclude parameter↗2019-03-14
▶
CVE-2019-1419 — Microsoft Windows vulnerability | cvebase