Remote code execution in Windows Adobe Type Manager Library
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2019-1419 CVE-2019-1456 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Windows Operating systems & Components / Operating system Windows Server Operating systems & Components / Operating system |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU22663
Risk: High
CVSSv3.1:
CVE-ID: CVE-2019-1419
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to the way Windows Adobe Type Manager Library handles specially crafted OpenType fonts. A remote attacker can create a specially crafted web page or document with embedded malicious font, trick the victim into opening it and execute arbitrary code on the system with privileges of the current user.
Mitigation
Install updates from vendor's website.
Vulnerable software versionsWindows: 7 - 10 1903
Windows Server: 2008 - 2019 1903
CPE2.3 External links
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1419
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
2) Input validation error
EUVDB-ID: #VU22710
Risk: High
CVSSv3.1:
CVE-ID: CVE-2019-1456
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to the way Windows Adobe Type Manager Library handles specially crafted OpenType fonts. A remote attacker can create a specially crafted web page or document with embedded malicious font, trick the victim into opening it and execute arbitrary code on the system with privileges of the current user.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows: 7 - 10 1903
Windows Server: 2008 - 2019 1903
CPE2.3 External links
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1456
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
