Technical Information

Brief overview of the risk:
The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded TrueType fonts.

Detailed Information on the risk:

An information disclosure vulnerability exists in Microsoft Windows when the Windows DirectWrite library improperly handles OpenType fonts. An attacker who successfully exploited this vulnerability could potentially read data which was not intended to be disclosed. Note that this vulnerability would not allow an attacker to execute code or to elevate their user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.
To exploit the vulnerability an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince a user to view the website. This could also include compromised websites and websites that accept or host user-provided content or advertisements. In all cases, however, an attacker would have no way to force users to visit such websites. Instead, an attacker would have to convince users to visit a website, typically by way of enticements in Instant Messenger or email messages.

Further information on this exploit is available at : MS15-044

Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 4
Microsoft .NET Framework 4.5/4.5.1/4.5.2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5.1