Microsoft Windows contains a flaw related to the atmfd.dll library that may allow for a denial of service. The issue is triggered when a user opens a malformed OpenType Font file, resulting in a loss of availability for the program. This can be exploited remotely by tricking a user into opening the crafted file (e.g., via email), or locally by placing it in a location that may seem safe (e.g., a network share).

OSVDB is not aware of a solution for this vulnerability.

• Exploit Database: 19089
• Secunia Advisory ID: 49514
• Other Advisory URL: http://blog.cr4.sh/2012/06/0day-windows.html
• Generic Exploit URL: http://dl.dropbox.com/u/22903093/blog/CFF_Type-1_0x0d_expl/CFF_Type-1_0x0d_expl.rar
• Packet Storm: http://packetstormsecurity.org/files/113562/OpenType-Denial-Of-Service.html

• Oleksiuk Dmytro

NVD does not currently have a CVSSv2 score assigned.