Microsoft · Windows Vista · CVE-2011-2003
**Name of the Vulnerable Software and Affected Versions**
Microsoft Windows XP versions SP2 through SP3
Microsoft Windows Server 2003 version SP2
Microsoft Windows Vista version SP2
Microsoft Windows Server 2008 versions SP2 through R2 SP1
Microsoft Windows 7 versions Gold through SP1
**Description**
A buffer overflow issue exists due to improper handling of specially crafted .fon font files, allowing remote attackers to execute arbitrary code. This could enable an attacker to run code in kernel-mode, install programs, view, change, or delete data, or create new accounts with full administrative rights.
**Recommendations**
For Microsoft Windows XP versions SP2 through SP3, apply the patch provided by Microsoft to fix the buffer overflow issue in win32k.sys.
For Microsoft Windows Server 2003 version SP2, apply the patch provided by Microsoft to fix the buffer overflow issue in win32k.sys.
For Microsoft Windows Vista version SP2, apply the patch provided by Microsoft to fix the buffer overflow issue in win32k.sys.
For Microsoft Windows Server 2008 versions SP2 through R2 SP1, apply the patch provided by Microsoft to fix the buffer overflow issue in win32k.sys.
For Microsoft Windows 7 versions Gold through SP1, apply the patch provided by Microsoft to fix the buffer overflow issue in win32k.sys.
As a temporary workaround, consider restricting access to .fon files until a patch is available.