CVE-2010-0250

CVE-2010-0250 is a DirectShow/Quartz heap overflow vulnerability in Microsoft DirectX where the AVI/QUartz AVI parser misallocates a buffer when processing a crafted AVI file’s length field, enabling remote code execution. Affected components include DirectShow (AVI Filter) and Quartz, with impac...

Microsoft DirectShow buffer overflow

Buffer overflow on AVI parsing...

CVE-2010-0250: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2, and in Quartz on Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server...

Microsoft Security Bulletin MS10-013 - Critical Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (977935)

Microsoft Security Bulletin MS10-013 - Critical Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution 977935 Published: February 09, 2010 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Microsoft DirectShow...

ZDI-10-015: Microsoft Windows RLE Video Decompressor Remote Code Execution Vulnerability

ZDI-10-015: Microsoft Windows RLE Video Decompressor Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-015 February 9, 2010 -- CVE ID: CVE-2010-0250 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows XP Microsoft Windows Vista --...

MS10-013: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (977935)

The version of Microsoft DirectShow installed on the remote host is affected by a heap-based buffer overflow that can be triggered when parsing AVI media files. If an attacker can trick a user on the affected host into opening a specially crafted AVI file, this issue could be leveraged to execute...

Microsoft DirectShow AVI Parser Heap Overflow (MS10-013; CVE-2010-0250)

Microsoft DirectShow is used for streaming media on Microsoft Windows operating systems. It is used for high-quality capture and playback of multimedia streams. Audio Video Interleave AVI is a file type that is used with applications that capture, edit, and play back audio-video sequences.A remot...

PT-2010-2050 · Microsoft · Directshow +8

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions prior to the fixed version Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 and SP3 Microsoft Windows Server 2003 SP2 Microsoft Windows Vista Gold, SP1, and SP2 Microsoft Windows Server 2008 Gold, SP2, and R2...

Microsoft Windows RLE Video Decompressor Remote Code Execution Vulnerability

This vulnerability allows attackers to execute arbitrary code on applications that utilize DirectShow for rendering video on Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must be coerced into decompressing a malicious video. The specific flaw...

Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption

msvidctlmpeg2.rb Microsoft DirectShow msvidctl.dll MPEG-2 Memory Corruption exploit for the Metasploit Framework Tested successfully on the following platforms fully patched 06/07/09: - Internet Explorer 6, Windows XP SP2 - Internet Explorer 7, Windows XP SP3 Original exploit was found in-the-wil...

Online Ad Site Hacked, Rigged to Serve Exploits

A high-profile online advertising Web site has been hacked and rigged to serve multiple exploits to Microsoft Windows users surfing the net with unpatched third party desktop software. According to a warning issued by Websense Security Labs, the malicious code was found on media-servers.net, whic...

Heap overflow

Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager ACM, does not properly initialize unspecified functions within compressed audio files, which allows remote attackers to execute arbitrary code via 1 a crafted...

CVE-2009-0555

The Microsoft Windows Media Runtime , utilized in DirectShow WMA Voice Codec , Windows Media Audio Voice Decoder , and Audio Compression Manager (ACM) , contains a memory corruption vulnerability. The root cause is a bound checking error in wmspdmod.dll where the software fails to properly saniti...

CVE-2009-0555

Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager ACM, does not properly process Advanced Systems Format ASF files, which allows remote attackers to execute arbitrary code via a crafted audio file that uses the...

CVE-2009-2525: Improper Control of Generation of Code

Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager ACM, does not properly initialize unspecified functions within compressed audio files, which allows remote attackers to execute arbitrary code via 1 a crafted...

CVE-2009-0555: Improper Control of Generation of Code

Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager ACM, does not properly process Advanced Systems Format ASF files, which allows remote attackers to execute arbitrary code via a crafted audio file that uses the...

Microsoft DirectShow AVI Decoder Buffer Overflow (MS05-050; CVE-2005-2128)

Microsoft DirectX is a set of low-level application programming interfaces APIs for creating high-performance multimedia applications. Microsoft DirectShow is an architecture for streaming media on the Microsoft Windows platform and provides for the capture and playback of multimedia streams. It...

Microsoft DirectX QuickTime媒体文件解析代码执行漏洞(MS09-028)

BUGTRAQ ID: 35139 CVECAN ID: CVE-2009-1537 Microsoft DirectX是Windows操作系统中的一项功能，流媒体在玩游戏或观看视频时通过这个功能支持图形和声音。 DirectX的DirectShow组件（quartz.dll）在解析畸形的QuickTime媒体文件时存在错误，用户受骗打开了恶意的媒体文件就会导致执行任意代码。由于用户可能在浏览器中安装媒体播放插件，因此访问恶意网页就足以导致播放QuickTime文件，触发Quartz.dll中的漏洞。 Microsoft DirectX 9.0 Microsoft DirectX 8.1...

CVE-2009-1538

The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 performs updates to pointers without properly validating unspecified data values, which allows remote attackers to execute...

CVE-2009-1539

The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 does not properly validate unspecified size fields in QuickTime media files, which allows remote attackers to execute...