Double free vulnerability in Microsoft Silverlight 4 before 4.1.10329 on Windows allows remote attackers to execute arbitrary code via vectors involving crafted XAML glyphs, aka "Silverlight Double-Free Vulnerability."

The version of Microsoft Silverlight installed on the remote host is reportedly affected by several vulnerabilities :

  - Incorrect handling of TrueType font (TTF) files could     lead to arbitrary code execution. (CVE-2011-3402 /     CVE-2012-0159)

  - A double-free condition leading to arbitrary code     execution could be triggered when rendering specially     crafted XAML glyphs. (CVE-2012-0176)

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the Win32k TrueType font parsing engine     that allows an unauthenticated, remote attacker to     execute arbitrary code by convincing a user to open a     Word document containing malicious font data.
    (CVE-2011-3402)

  - A flaw exists in the t2embed.dll module when parsing     TrueType fonts. An unauthenticated, remote attacker can     exploit this, via a crafted TTF file, to execute     arbitrary code. (CVE-2012-0159)

  - A flaw exists in the .NET Framework due to a buffer     allocation error when handling an XBAP or .NET     application. An unauthenticated, remote attacker can     exploit this, via a specially crafted application, to     execute arbitrary code. (CVE-2012-0162)

  - A flaw exists in the .NET Framework due to an error     when comparing the value of an index in a WPF     application. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.
    (CVE-2012-0164)

  - A flaw exists in GDI+ when handling specially crafted     EMF images that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2012-0165)

  - A heap buffer overflow condition exists in Microsoft     Office in the GDI+ library when handling EMF images     embedded in an Office document. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code by convincing a user to open a specially crafted     document. (CVE-2012-0167)

  - A double-free error exists in agcore.dll when rendering     XAML strings containing Hebrew Unicode glyphs of certain     values. An unauthenticated, remote attacker can exploit     this to execute arbitrary code by convincing a user to     visit a specially crafted web page. (CVE-2012-0176)

  - A privilege escalation vulnerability exists in the     way the Windows kernel-mode driver manages the functions     related to Windows and Messages handling. A local     attacker can exploit this, via a specially crafted     application, to gain elevated privileges.
    (CVE-2012-0180)

  - A privilege escalation vulnerability exists in the way     the Windows kernel-mode driver manages Keyboard Layout     files. A local attacker can exploit this, via a     specially crafted application, to gain elevated     privileges. (CVE-2012-0181)

  - A privilege escalation vulnerability exists in the way     the Windows kernel-mode driver manages scrollbar     calculations. A local attacker can exploit this, via a     specially crafted application, to gain elevated     privileges. (CVE-2012-1848)

ID	Name	Product	Family	Severity
59045	MS12-034: Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight (2681578) (Mac OS X)	Nessus	MacOS X Local Security Checks	high
59042	MS12-034: Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight (2681578)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2012-0176

high

Tenable Plugins

high

high