Microsoft Windows GDI CreateDIBPatternBrushPt函数堆溢出漏洞（MS08-021）

Microsoft Windows是微软发布的非常流行的操作系统。 Windows的GDI函数CreateDIBPatternBrushPt用于处理WMF文件。由于错误地计算了用户数据，可能没有充分地分配堆块并在之后使用了该块，导致堆溢出。此外在解析EMF文件中用于描述文件中所包含位图的头结构时，直接在计算所要分配字节数的算术操作中使用了这个头中的一些值，这个计算可能溢出，最终导致堆溢出。如果用户受骗打开了特制的图形文件的话，就可能触发这些溢出，导致执行任意指令。 Microsoft Windows XP SP2 Microsoft Windows Vista SP1 Microsoft...

Microsoft Windows GDI multiple security vulnerabilities

Multiple buffer overflows on EMF and WMF files parsing...

Windows GDI EMF filename buffer overflow

Added: 04/09/2008 CVE: CVE-2008-1087 BID: 28570 OSVDB: 44215 Background The Windows Graphics Device Interface GDI interacts with graphics device drivers on behalf of applications. Problem A buffer overflow in Windows GDI allows command execution when a user opens a specially crafted EMF file...

Windows GDI EMF filename buffer overflow

Added: 04/09/2008 CVE: CVE-2008-1087 BID: 28570 OSVDB: 44215 Background The Windows Graphics Device Interface GDI interacts with graphics device drivers on behalf of applications. Problem A buffer overflow in Windows GDI allows command execution when a user opens a specially crafted EMF file...

Windows GDI EMF filename buffer overflow

Added: 04/09/2008 CVE: CVE-2008-1087 BID: 28570 OSVDB: 44215 Background The Windows Graphics Device Interface GDI interacts with graphics device drivers on behalf of applications. Problem A buffer overflow in Windows GDI allows command execution when a user opens a specially crafted EMF file...

Windows GDI EMF filename buffer overflow

Added: 04/09/2008 CVE: CVE-2008-1087 BID: 28570 OSVDB: 44215 Background The Windows Graphics Device Interface GDI interacts with graphics device drivers on behalf of applications. Problem A buffer overflow in Windows GDI allows command execution when a user opens a specially crafted EMF file...

Heap overflow

Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow...

Stack overflow

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

CVE-2008-1087

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

CVE-2008-1083

Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow...

CVE-2008-1087

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

CVE-2008-1083

Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow...

CVE-2008-1083

CVE-2008-1083 describes a remote-code-execution vulnerability in the Windows GDI component. The flaw occurs in the CreateDIBPatternBrushPt function when parsing malformed EMF/WMF image headers, leading to a heap-based/integer overflow in GDI and potentially arbitrary code execution on affected sy...

Microsoft Windows GDI EMF Image File Handling Stack Overflow (MS08-021; CVE-2008-1087)

A remote code execution vulnerability has been reported in the way Microsoft GDI handles the filename parameter in EMF files. The Microsoft Windows graphics device interface GDI enables applications to use graphics and formatted text on the video display and on the printer. EMF is a image format...

Evolution format string flaw

Format string vulnerability in the emfmultipartencrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field...

Re: GDI+ and Internet Explorer question

IE has its own image decoders for many image types jpeg, ico, etc. You can trigger this bug remotely by renaming your .ico to .emf or .wmf, which forces it be opened by the Picture and Fax Viewer using GDI+. -HD On Saturday 09 June 2007 06:40, [email protected] wrote: fails to crash my Internet...

Buffer overflow

Buffer overflow in the Graphics Device Interface GDI in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via a crafted Enhanced Metafile EMF image format file...

CVE-2007-1212

The CVE-2007-1212 entry concerns a buffer overflow in the Graphics Device Interface (GDI) when processing Enhanced Metafile (EMF) images. Affected products listed in the initial description are Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, SP2; and Windows Vista. The underlying issue is a GDI ...

Microsoft Windows Graphics Rendering Engine EMF File Privilege Escalation Vulnerability

Description Microsoft Windows Graphics Rendering Engine is prone to a local privilege-escalation vulnerability when rendering malformed EMF image files. An attacker may exploit this issue to execute arbitrary code with SYSTEM-level privileges, facilitating the complete compromise of affected...

GLSA-200701-07 : OpenOffice.org: EMF/WMF file handling vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200701-07 OpenOffice.org: EMF/WMF file handling vulnerabilities John Heasman of NGSSoftware has discovered integer overflows in the EMRPOLYPOLYGON and EMRPOLYPOLYGON16 processing and an error within the handling of METAESCAPE...