Peter Ferrie

**Name of the Vulnerable Software and Affected Versions** Trend Micro Security 2020 versions 16.0.0.1302 and below **Description** An invalid memory read issue in the driver of Trend Micro Security 2020 consumer products could allow an attacker to manipulate the driver, causing it to perform a system call operation with an invalid address. This could result in a potential system crash. **Recommendations** For versions 16.0.0.1302 and below, update to a version above 16.0.0.1302 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows scripting engines versions 5.1 and 5.6 **Description** The issue is related to the improper decoding of script by the VBScript and JScript scripting engines. This allows remote attackers to execute arbitrary code via unknown vectors. **Recommendations** For versions 5.1 and 5.6 of the scripting engines, update to a newer version that properly decodes script to prevent the execution of arbitrary code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** The issue is related to an integer overflow in the PolyPolygon function within the Graphics Rendering Engine. This allows remote attackers to execute arbitrary code through a Windows Metafile (WMF) or EMF image that triggers a heap-based buffer overflow by manipulating the sum of entries in the vertext counts array and the number of polygons. **Recommendations** For Microsoft Windows 98 and Me, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows 2000 SP4 Windows XP SP1 Windows XP SP2 Windows Server 2003 SP1 Description: The issue is related to an unspecified vulnerability in the Graphics Rendering Engine, specifically in the GDI32.DLL component, which is associated with an unchecked buffer and possibly buffer overflows. This allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF) format image. Recommendations: For Windows 2000 SP4, update to a version that includes the fix for this issue. For Windows XP SP1, update to a version that includes the fix for this issue. For Windows XP SP2, update to a version that includes the fix for this issue. For Windows Server 2003 SP1, update to a version that includes the fix for this issue.