Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2015-2426

Published: 20/07/2015 Updated: 15/05/2019
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 940
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Windows Server 2012

Vulnerability Summary

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote malicious users to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows server 2012 r2

microsoft windows 8 -

microsoft windows vista -

microsoft windows 10 -

microsoft windows rt -

microsoft windows rt 8.1 -

microsoft windows server 2008 r2

microsoft windows 7 -

microsoft windows server 2008 -

microsoft windows server 2012 -

microsoft windows 8.1 -

Exploits

Exploit DB: Microsoft Windows - Font Driver Buffer Overflow (MS15-078) (Metasploit)
## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' require 'msf/core/post/windows/reflective_dll_injection' require 'rex' class Metasploit3 < Msf::Exploit::Local Rank = ManualRanking WIN32K_VERSIONS = [ '63960017393', '639 ...
Exploit DB: MS15-078 Microsoft Windows Font Driver Buffer Overflow
This Metasploit module exploits a pool based buffer overflow in the atmfddll driver when parsing a malformed font The vulnerability was exploited by the hacking team and disclosed on the july data leak This Metasploit module has been tested successfully on vulnerable builds of Windows 81 x64 ...

Github Repositories

https://github.com/ZiDuNet/Note

安全，渗透

Note 漏洞及渗透练习平台： WebGoat漏洞练习平台： githubcom/WebGoat/WebGoat webgoat-legacy漏洞练习平台: githubcom/WebGoat/WebGoat-Legacy zvuldirll漏洞练习平台： githubcom/710leo/ZVulDrill vulapps漏洞练习平台： githubcom/Medicean/VulApps dvwa漏洞练习平台： githubcom/RandomStorm/DVWA 数据库

https://github.com/hantiger/-

漏洞及渗透练习平台 数据库注入练习平台 花式扫描器 信息搜集工具 WEB工具 windows域渗透工具 漏洞利用及攻击框架 漏洞POC&EXP 中间人攻击及钓鱼 密码破解 二进制及代码分析工具 EXP编写框架及工具 隐写相关工具 各类安全资料 各类CTF资源 各类编程资源 Python 漏洞及渗透练习平台 WebG

https://github.com/hackstoic/hacker-tools-projects

title 黑客工具大搜罗 各种好玩的安全攻防工具。 安全工具（go语言） 序号 名称 项目地址 简介 1 gomitmproxy githubcom/sheepbao/gomitmproxy GomitmProxy是想用golang语言实现的mitmproxy，主要实现http代理，目前实现了http代理和https抓包功能。 2 Hyperfox githubcom/xiam/hyperfox

https://github.com/sathwikch/windows-exploitation

Awesome Windows Exploitation A curated list of awesome Windows Exploitation resources, and shiny things There is no pre-established order of items in each category, the order is for contribution If you want to contribute, please read the guide Table of Contents Windows stack overflows Windows heap overflows Kernel based Windows overflows Windows Kernel Memory Corruption Re

https://github.com/googleprojectzero/BrokenType

TrueType and OpenType font fuzzing toolset

BrokenType BrokenType is a set of tools designed to test the robustness and security of font rasterization software, especially codebases prone to memory corruption issues (written in C/C++ and similar languages) It consists of the following components: TrueType program generator - a Python script for generating random, but valid TrueType programs TTF/OTF mutator - a semi-&q

https://github.com/Vxer-Lee/Hack_Tools

黑客工具库

漏洞及渗透练习平台： WebGoat漏洞练习平台： githubcom/WebGoat/WebGoat webgoat-legacy漏洞练习平台: githubcom/WebGoat/WebGoat-Legacy zvuldirll漏洞练习平台： githubcom/710leo/ZVulDrill vulapps漏洞练习平台： githubcom/Medicean/VulApps dvwa漏洞练习平台： githubcom/RandomStorm/DVWA 数据库注入

https://github.com/scuechjr/Sec-Box

简介 Copy From tengzhangchao 's githubcom/tengzhangchao/Sec-Boxgit 20190810 src：安全行业小工具以及学习资源收集项目，此项目部分内容来自：wwwt00lsnet/thread-38964-1-1html 感谢其分享，这里只是作为个人备份，如有问题可邮件通知。 安全资源 安全资源包括安全书籍，资料，安全教程

https://github.com/1o24er/Python-

Python工具库（感谢backlion整理） 漏洞及渗透练习平台： WebGoat漏洞练习平台： githubcom/WebGoat/WebGoat webgoat-legacy漏洞练习平台: githubcom/WebGoat/WebGoat-Legacy zvuldirll漏洞练习平台： githubcom/710leo/ZVulDrill vulapps漏洞练习平台： githubcom/Medicean/VulApps dvwa漏洞练习平台： g

https://github.com/cream492/pentest-tools

渗透测试必备工具

-渗透测试必备工具 网上看到渗透测试工具总结不错的文章，转发过来供大家一起学习，链接为：wwwjianshucom/p/9936da5effed 以及wwwsec-redclubcom/indexphp/archives/484/ 如有问题，请联系我！ WebGoat漏洞练习环境 githubcom/WebGoat/WebGoat githubcom/WebGoat/WebGoat-Legacy Damn Vulnerable Web Ap

https://github.com/githuberxu/Project

简介 安全行业小工具以及学习资源收集项目，此项目部分内容来自：wwwt00lsnet/thread-38964-1-1html 感谢其分享，这里只是作为个人备份，如有问题可邮件通知。 安全资源 安全资源包括安全书籍，资料，安全教程，学习平台等等。 设备基线加固资料 githubcom/re4lity/Benchmarks

https://github.com/sathwikch/awesome-windows-exploitation

Awesome Windows Exploitation A curated list of awesome Windows Exploitation resources, and shiny things There is no pre-established order of items in each category, the order is for contribution If you want to contribute, please read the guide Table of Contents Windows stack overflows Windows heap overflows Kernel based Windows overflows Windows Kernel Memory Corruption Re

https://github.com/Ministrex/osee

Resources Collection of resources for my preparation to take the OSEE certification Based on the syllabus from Offensive Security My review can be found here Browser Exploitation Safari/Chrome/Webkit Exploiting a Safari information leak by Bruno Keith Attacking Client-Side JIT Compilers by Samuel Groß Exploiting Logic Bugs in JavaScript JIT Engines by Samuel

https://github.com/yige666/web-

简介 安全行业小工具以及学习资源收集项目，此项目部分内容来自：wwwt00lsnet/thread-38964-1-1html 感谢其分享，这里只是作为个人备份，如有问题可邮件通知。 安全资源 安全资源包括安全书籍，资料，安全教程，学习平台等等。 设备基线加固资料 githubcom/re4lity/Benchmarks

https://github.com/dhn/OSEE

Collection of resources for my preparation to take the OSEE certification.

Resources Collection of resources for my preparation to take the OSEE certification Based on the syllabus from Offensive Security My review can be found here Browser Exploitation Safari/Chrome/Webkit Exploiting a Safari information leak by Bruno Keith Attacking Client-Side JIT Compilers by Samuel Groß Exploiting Logic Bugs in JavaScript JIT Engines by Samuel

https://github.com/birdhan/Security_Tools

渗透测试工具包 | 开源安全测试工具 | 网络安全工具

项目介绍（攻击视角） 搜集大量网络安全行业开源项目，旨在提供安全测试工具，提升渗透测试效率。 项目收集的思路： 一个是以攻击/漏洞视角出发的开源项目，经网络安全爱好者实践总结出的经验。 一个是从渗透测试流程出发，沿着信息收集到内网渗透的思路，总结出漏洞扫描、漏

https://github.com/jay900323/SecurityTools

网络安全工具汇总

SecurityTools 网络安全工具汇总 漏洞及渗透练习平台 WebGoat漏洞练习环境 githubcom/WebGoat/WebGoat githubcom/WebGoat/WebGoat-Legacy Damn Vulnerable WebApplication（漏洞练习平台） githubcom/RandomStorm/DVWA 数据库注入练习平台 githubcom/Audi-1/sqli-labs 用node编写的漏洞练习平台，like OWASP Node Go

https://github.com/vlad902/hacking-team-windows-kernel-lpe

Previously-0day exploit from the Hacking Team leak, written by Eugene Ching/Qavar.

This an exploit for CVE-2015-2426 (MS-078), a Windows kernel local privilege escalation 0day from the Hacking Team archive (email here) It was developed by Eugene Ching / Qavar security Original contents below: Summary Windows kernel memory corruption exploit leading to privilege escalation Tested on Windows 81 fully-patched (as of 28 Jan 2015) Also tested to work against

https://github.com/birdhan/SecurityTools

渗透测试工具包 | 开源安全测试工具 | 网络安全工具

项目介绍（攻击视角） 搜集大量网络安全行业开源项目，旨在提供安全测试工具，提升渗透测试效率。 项目收集的思路： 一个是以攻击/漏洞视角出发的开源项目，经网络安全爱好者实践总结出的经验。 一个是从渗透测试流程出发，沿着信息收集到内网渗透的思路，总结出漏洞扫描、漏

Recent Articles

Microsoft: Hey, you. Done patching Windows this month? WRONG
The Register • Chris Williams, Editor in Chief • 20 Jul 2015

Yet another serious vulnerability emerges from leaked Hacking Team archives

Microsoft is urging everyone to install an emergency security update for all supported versions of Windows to fix a remote-code execution vulnerability. Details of the vulnerability were found and reported to Microsoft by security researchers poring over internal memos leaked online from spyware-maker Hacking Team. This follows an elevation-of-privilege hole in Windows and a remote-code execution bug in Internet Explorer 11 that were also uncovered from the Hacking Team files, and patched last w...

Read more...

References

CWE-119http://www.kb.cert.org/vuls/id/103336http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/http://www.securityfocus.com/bid/75951https://www.exploit-db.com/exploits/38222/http://www.securitytracker.com/id/1032991https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-078https://nvd.nist.govhttps://www.exploit-db.com/exploits/38222/https://github.com/ZiDuNet/Note
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook