Overview
Microsoft Windows GDI contains an integer overflow in the handling of Windows metafiles, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Description
Microsoft Windows GDI (Graphics Device Interface) enables applications to use graphics and formatted text on both video displays and printers. GDI can be used to handle bitmaps, metafiles, and fonts. Microsoft Windows GDI contains an integer overflow vulnerability in the AttemptWrite() function. This integer overflow leads to a heap overflow. |
Impact
By convincing a user to view a specially crafted metafile, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the user. |
Solution
Apply an update This vulnerability is addressed by Microsoft Security Bulletin MS07-046. This bulletin provides an updated version of GDI. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Microsoft for reporting this vulnerability, who in turn credit eEye Digital Security.
This document was written by Will Dormann.
Other Information
| CVE IDs: | CVE-2007-3034 |
| Severity Metric: | 27.34 |
| Date Public: | 2007-08-14 |
| Date First Published: | 2007-08-14 |
| Date Last Updated: | 2007-08-14 20:58 UTC |
| Document Revision: | 6 |