CVE-2012-2897 | BDVDB-2026-52668 Detail
Description#
The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and other programs, do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted TrueType font file, aka "Windows Font Parsing Vulnerability" or "TrueType Font Parsing Vulnerability."
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.
Weaknesses#
No weakness recorded in the source data.
References#
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78822
- http://www.us-cert.gov/cas/techalerts/TA12-318A.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15847
- http://www.securitytracker.com/id?1027750
- http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
- https://code.google.com/p/chromium/issues/detail?id=146254
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075
- http://secunia.com/advisories/51239
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.