#Font viewer win7 driver#
#Font viewer win7 Patch#
#Font viewer win7 windows 10#
#Font viewer win7 pro#

We list them here in some detail and provide pros and cons for each. Microsoft's advisory provides three mitigation approaches that, in varying degrees, prevent exploitation of these vulnerabilities.

#Font viewer win7 windows 10#

(Note that Microsoft subsequently updated the severity of Windows 10 client and server products from Critical to Important, with which we agree.) Based on this comparison by Didier Stevens, fontdrvhost.exe likely has the same code for processing Adobe Type 1 PostScript and OpenType fonts as ATMFD.DLL, which explains why newer Windows 10 systems that do not have ATMFD.DLL at all, are also affected.

#Font viewer win7 driver#

Vulnerabilities are in ATMFD.DLL, a kernel font driver responsible for processing Adobe Type 1 PostScript and OpenType fonts.

On these systems, a remote code execution issue in font parsing will get attacker's code executed in an AppContainer sandbox, which requires another vulnerability to escape it. On Windows 10 v1709 and later, and their server counterparts, font parsing was moved to a sandboxed user-space process fontdrvhost.exe.

On Windows systems before Windows 10 v1709 and their server counterparts, font parsing is performed in the kernel, which provides immediate code execution with highest privileges, potentially even from a sandboxed document-viewing application.

In addition, Microsoft's advisory states that Outlook preview is not an attack vector. Other major browsers like Firefox or Chrome are certainly not attack vectors for these vulnerabilities. However, we were unable to find any confirmation that Adobe Type 1 PostScript fonts could be provided by a web site at all, and therefore consider Internet Explorer unlikely to be an attack vector.

We initially thought that Internet Explorer could be an attack vector too while visiting a malicious web site that would provide its own malformed font to the browser.

Both vulnerabilities are in font parsing, which provides powerful attack vectors such as just viewing font files in Windows Explorer, or opening a malicious document.

Microsoft's advisory provides scarce details, for obvious reasons, but here's what we think is important:

#Font viewer win7 pro#

Our patches thus ceased being free and now require a PRO license. Update: Microsoft issued an official fix for this issue with April 2020 Windows Updates and assigned two CVE IDs to it: CVE-2020-0938 and CVE-2020-1020. We will likely not port the micropatch to Windows 10 and newer Servers as the risk from these vulnerabilities is much lower there. Of course our next step will be to port the micropatch to other affected Windows versions including Windows 7 and Windows Server 2008 R2 with ESU, Windows 8.1 and Windows Server 2012, both 32-bit and 64-bit.

#Font viewer win7 Patch#

This provides protection for our users who continue using these Windows versions but were unable or unwilling to obtain ESU, and are now, somewhat ironically, the only Windows users with a patch for these vulnerabilities. Our micropatch is currently available for fully updated Windows 7 64-bit and Windows Server 2008 R2 without Extended Security Updates (ESU), which means with January 2020 Windows Updates installed. Three days ago, Microsoft published a security advisory alerting about two vulnerabilities in Windows font parsing, which were noticed as being exploited in 'limited targeted Windows 7 based attacks.' These vulnerabilities currently don't have an official vendor fix.Īs we've done before in a similar situation, we decided to provide our users with a micropatch to protect themselves against these vulnerabilities in a '0patch fashion', i.e., completely automatically and without disturbing users even in the slightest.