Heap overflow

Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow...

Stack overflow

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

CVE-2008-1083

Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow...

CVE-2008-1087

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

CVE-2008-1087

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

CVE-2008-1083

Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow...

CVE-2008-1083

CVE-2008-1083 describes a remote-code-execution vulnerability in the Windows GDI component. The flaw occurs in the CreateDIBPatternBrushPt function when parsing malformed EMF/WMF image headers, leading to a heap-based/integer overflow in GDI and potentially arbitrary code execution on affected sy...

Microsoft Windows GDI EMF Image File Handling Stack Overflow (MS08-021; CVE-2008-1087)

A remote code execution vulnerability has been reported in the way Microsoft GDI handles the filename parameter in EMF files. The Microsoft Windows graphics device interface GDI enables applications to use graphics and formatted text on the video display and on the printer. EMF is a image format...

CVE-2008-1087: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

Evolution format string flaw

Format string vulnerability in the emfmultipartencrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field...

Re: GDI+ and Internet Explorer question

IE has its own image decoders for many image types jpeg, ico, etc. You can trigger this bug remotely by renaming your .ico to .emf or .wmf, which forces it be opened by the Picture and Fax Viewer using GDI+. -HD On Saturday 09 June 2007 06:40, [email protected] wrote: fails to crash my Internet...

Buffer overflow

Buffer overflow in the Graphics Device Interface GDI in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via a crafted Enhanced Metafile EMF image format file...

CVE-2007-1212

The CVE-2007-1212 entry concerns a buffer overflow in the Graphics Device Interface (GDI) when processing Enhanced Metafile (EMF) images. Affected products listed in the initial description are Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, SP2; and Windows Vista. The underlying issue is a GDI ...

CVE-2007-1212: Undefined Security Weakness

Buffer overflow in the Graphics Device Interface GDI in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via a crafted Enhanced Metafile EMF image format file...

Microsoft Windows Graphics Rendering Engine EMF File Privilege Escalation Vulnerability

Description Microsoft Windows Graphics Rendering Engine is prone to a local privilege-escalation vulnerability when rendering malformed EMF image files. An attacker may exploit this issue to execute arbitrary code with SYSTEM-level privileges, facilitating the complete compromise of affected...

GLSA-200701-07 : OpenOffice.org: EMF/WMF file handling vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200701-07 OpenOffice.org: EMF/WMF file handling vulnerabilities John Heasman of NGSSoftware has discovered integer overflows in the EMRPOLYPOLYGON and EMRPOLYPOLYGON16 processing and an error within the handling of METAESCAPE...

OpenOffice WMF/EMF文件处理堆溢出漏洞

OpenOffice是个整合性的软件，包含了许多文字处理、表格、公式等办公工具。 OpenOffice在处理METAESCAPE记录时存在截尾错误。在svtools\source\filter.vcl\wmf\winwmf.cxx文件中： case WMETAESCAPE : ... saluInt32 i, nStringLen, nDXCount; ... aMemoryStream aPt.X aPt.Y nStringLen; salUnicode pBuf = aString.AllocBuffer saluInt16nStringLen ; for i = 0; i...

OpenOffice.org: EMF/WMF file handling vulnerabilities

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description John Heasman of NGSSoftware has discovered integer overflows in the EMRPOLYPOLYGON and...

OpenOffice fails to properly process WMF and EMF files

Overview Multiple buffer overflow vulnerabilities exist in the OpenOffice.org office suite. If successfully exploited, these vulnerabilities may allow an attacker to execute arbitrary code on a vulnerable system. Description OpenOffice.org is a free office suite that is available for multiple...

CVE-2006-5870

CVE-2006-5870 affects OpenOffice.org 2.0.4 and earlier and StarOffice 6–8, enabling user-assisted remote code execution via crafted WMF/EMF files that trigger heap-based overflows during META_ESCAPE and EMR_POLYPOLYGON processing. Connected advisories (e.g., RHSA-2007:0001) confirm a backported f...