CVE-2019-1456 — Microsoft Windows vulnerability

12 documents6 sources
Severity
8.8HIGHNVD
EPSS
14.9%
top 5.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+6 more
Timeline
PublishedNov 12
Latest updateMay 24

Description

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts, aka 'OpenType Font Parsing Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1419.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/windows18 versions+17
▶NVDmicrosoft/windowsr2, 1803, 1903+2
▶NVDmicrosoft/windows_105 versions+4
▶CVEListV5microsoft/windows_server17 versions+16

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-6fvv-v56q-722c: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2022-05-24
▶
GHSA
GHSA-j7vv-hfcm-2mq5: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2022-05-24
▶
CVEList
CVE-2019-1456: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2019-11-12
▶
CVEList
CVE-2019-1419: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted Ope↗2019-11-12
▶

📋Vendor Advisories

1
Microsoft
OpenType Font Parsing Remote Code Execution Vulnerability↗2019-11-12
▶

🕵️Threat Intelligence

2
Talos
Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage↗2019-11-12
▶
Talos
Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage↗2019-11-12
▶

💬Community

3
Bugzilla
CVE-2019-10157 keycloak: Node.js adapter internal NBF can be manipulated leading to DoS.↗2019-04-25
▶
Bugzilla
CVE-2018-20677 bootstrap: XSS in the affix configuration target property↗2019-01-21
▶
Bugzilla
CVE-2018-14041 bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy↗2018-07-16
▶
CVE-2019-1456 — Microsoft Windows vulnerability | cvebase