Multiple vulnerabilities have been identified in Microsoft Windows, which could be exploited by remote or local attackers to take complete control of an affected system.
The first issue is due to an incorrect handling of memory reserved for the Windows kernel by the Windows Graphics Rendering Engine when processing WMF and EMF file types, which could be exploited by malicious users to execute arbitrary commands with elevated privileges. For additional information, see : FrSIRT/ADV-2006-4358
The second vulnerability is due to a stack overflow error when handling malformed cursors, animated cursors and icons, which could be exploited by remote attackers to execute arbitrary. For additional information, see : FrSIRT/ADV-2007-1151
The third issue is due to an error when processing data read from a malformed Windows Metafile (WMF) image, which could be exploited by attackers to cause a denial of service.
The fourth vulnerability is due to a buffer overflow error in GDI when rendering Enhanced Metafile (EMF) image format files, which could be exploited by malicious users to execute arbitrary commands with elevated privileges.
The fifth issue is due to an error in the graphics device interface (GDI) when processing application window sizes, which could be exploited by local attackers to obtain elevated privileges.
The sixth vulnerability is due to a buffer overflow error in the graphics device interface (GDI) when handling color-related parameters read from certain types of images, which could be exploited by malicious users to execute arbitrary commands with elevated privileges.
The seventh issue is due to an error in the TrueType Font Rasterizer that calls an uninitialized function pointer when processing defective or modified fonts, which could be exploited by malicious users to obtain elevated privileges.
Credits
Vulnerabilities reported by Alexander Sotirov (Determina Security Research), iDefense, Shaun Colley (NGS Software), Thomas Phinney (Adobe Systems) and Sergey Svinolobov.
ChangeLog
2007-04-03 : Initial release
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
