Thomas Garnier

The issue is caused by an integer overflow in the load multiboot function, located in hw/i386/multiboot.c, which is part of the QEMU emulator. This can be exploited by an attacker in the local guest operating system, allowing them to execute arbitrary code on the host operating system. The exploitation is possible through specially crafted multiboot header address values, leading to an out-of-bounds write.

The issue is related to an integer overflow in the Embedded OpenType (EOT) Font Engine, allowing remote attackers to execute arbitrary code via a crafted name table. A remote code execution vulnerability exists in the way that Microsoft Windows Embedded OpenType (EOT) font technology parses name tables in specially crafted embedded fonts. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue arises from the QuickTime Movie Parser Filter in quartz.dll, which fails to properly validate size fields in QuickTime media files. This allows remote attackers to execute arbitrary code via a crafted file. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the QuickTime Movie Parser Filter in DirectShow to minimize the risk of arbitrary code execution.

The issue arises from the kernel's failure to properly validate user-mode pointers in certain error conditions, allowing local users to gain privileges via a crafted application. This is due to insufficient validation of certain pointers passed from user mode, which could enable an attacker to run arbitrary code in kernel mode. As a result, an attacker could install programs, view, change, or delete data, or create new accounts with full user rights.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue allows remote attackers to execute arbitrary code via a crafted QuickTime media file. This has been exploited in the wild. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, update to a version that is not affected by this issue to prevent remote attackers from executing arbitrary code.

The Windows kernel does not properly validate handles, allowing local users to gain privileges via a crafted application. This could enable an attacker to run arbitrary code in kernel mode, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000 SP4, XP SP2, XP SP3, Server 2003 SP1, Server 2003 SP2, Vista Gold, Vista SP1, Server 2008 Description: The issue arises from the Windows kernel's failure to properly validate input passed from user mode, allowing local users to gain privileges via a crafted application. This could enable an attacker to run code with elevated privileges, execute arbitrary code, and take complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Recommendations: For Microsoft Windows 2000 SP4, consider applying a patch to fix the kernel memory corruption issue. For Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, apply a patch to address the improper validation of input passed from user mode to the kernel. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper input validation in the Windows kernel, allowing local users to execute arbitrary code. This could enable an attacker to run code with elevated privileges, potentially leading to complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. One affected function is `NtUserFnOUTSTRING` in `win32k.sys`.

The issue allows remote attackers to cause a denial of service, resulting in the system hanging and restarting, via a crafted LDAP request to Active Directory or Active Directory Application Mode (ADAM).