MS15-051: Vulnerabilities in Windows kernel-mode drivers could allow information disclosure: May 12, 2015

Summary

This security update resolves vulnerabilities in Windows, the Microsoft .NET Framework, Microsoft Office, Microsoft Lync, and Microsoft Silverlight. The more severe of these vulnerabilities could allow for one of the following scenarios:

• Remote code execution if a user opens a specially crafted document or goes to an untrusted webpage that contains embedded TrueType fonts

• Elevation of privilege if an attacker logs on locally and runs arbitrary code in kernel mode. An attacker could then take the following actions:

  • Install programs
  • View, change, or delete data
  • Create new accounts that have full user rights

An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability cannot be exploited remotely or by anonymous users.

Introduction

Microsoft has released security bulletin MS15-051. To learn more about this security bulletin:

• Home users:

  https:⁠//www.microsoft.com/security/pc-security/updates.aspx Skip the details: Download the updates for your home computer or laptop from the Microsoft Update website now:

  https:⁠//update.microsoft.com/microsoftupdate/

• IT professionals:

  https:⁠//technet.microsoft.com/library/security/MS15-051

How to obtain help and support for this security update

Help installing updates:
Support for Microsoft Update

Security solutions for IT professionals:
TechNet Security Troubleshooting and Support

Help protect your Windows-based computer from viruses and malware:
Virus Solution and Security Center

Local support according to your country:
International Support

More Information

Known issues and additional information about this security update

The following article contains additional information about this security update as it relates to individual product versions. The article may contain  information about known issues.

• 3045171 MS15-044 and MS15-051: Description of the security updates for Windows font drivers Known issues in security update 3045171:

  • After you install this security update (3045171), you experience crashes when you use Windows GDI+ to create text outline-based path objects on a computer that's running Windows 7 or an earlier version of Windows.

    To resolve this problem, install update 3065979. For more information, click the following article number to go to the article in the Microsoft Knowledge Base:

    3065979 "GsDraw error (1): GenericError" error occurs and application crashes when you create text outline in Windows

  • After you install this security update (3045171) on a computer that's running Windows Vista or Windows Server 2008, you may receive an error message that resembles the following for the FontCache service in the Services Microsoft Management Console (MMC):

    Note

    Failed to Read Description. Error Code: 15100

    When you open FontCache service in the Services MMC, you may receive an error message that resembles the following:

    Note

    Configuration Manager: A general error occurred

    The resource loader failed to find MUI file

    To resolve this problem, install update 971512. For more information, click the following article number to go to the article in the Microsoft Knowledge Base:

    971512 Description of the Windows Graphics, Imaging, and XPS Library

File information