Thomas Garnier

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** The issue is caused by an integer overflow in the load multiboot function, located in hw/i386/multiboot.c, which is part of the QEMU emulator. This can be exploited by an attacker in the local guest operating system, allowing them to execute arbitrary code on the host operating system. The exploitation is possible through specially crafted multiboot header address values, leading to an out-of-bounds write. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** The issue is related to an integer overflow in the Embedded OpenType (EOT) Font Engine, allowing remote attackers to execute arbitrary code via a crafted name table. A remote code execution vulnerability exists in the way that Microsoft Windows Embedded OpenType (EOT) font technology parses name tables in specially crafted embedded fonts. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. **Recommendations** For Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2, update to a version that includes the fix for the Embedded OpenType Font Integer Overflow issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue arises from the QuickTime Movie Parser Filter in quartz.dll, which fails to properly validate size fields in QuickTime media files. This allows remote attackers to execute arbitrary code via a crafted file. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the QuickTime Movie Parser Filter in DirectShow to minimize the risk of arbitrary code execution.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 and SP3 Microsoft Windows Server 2003 SP2 Microsoft Windows Vista Gold, SP1, and SP2 Microsoft Windows Server 2008 SP2 **Description** The issue arises from the kernel's failure to properly validate user-mode pointers in certain error conditions, allowing local users to gain privileges via a crafted application. This is due to insufficient validation of certain pointers passed from user mode, which could enable an attacker to run arbitrary code in kernel mode. As a result, an attacker could install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Windows 2000 SP4, update to a newer version to mitigate the risk. For Microsoft Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 SP2, update to a newer version to mitigate the risk. For Microsoft Windows Vista Gold, SP1, and SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 SP2, update to a newer version to mitigate the risk.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue allows remote attackers to execute arbitrary code via a crafted QuickTime media file. This has been exploited in the wild. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, update to a version that is not affected by this issue to prevent remote attackers from executing arbitrary code.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions 2000 SP4, XP SP2, XP SP3, Server 2003 SP1, Server 2003 SP2, Vista Gold, Vista SP1, Server 2008 **Description** The Windows kernel does not properly validate handles, allowing local users to gain privileges via a crafted application. This could enable an attacker to run arbitrary code in kernel mode, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights. **Recommendations** For Windows 2000 SP4, update to a newer version to mitigate the risk. For Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Windows Server 2003 SP1 and SP2, update to a newer version to mitigate the risk. For Windows Vista Gold and SP1, update to a newer version to mitigate the risk. For Windows Server 2008, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the kernel until a patch is available.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000 SP4, XP SP2, XP SP3, Server 2003 SP1, Server 2003 SP2, Vista Gold, Vista SP1, Server 2008 Description: The issue arises from the Windows kernel's failure to properly validate input passed from user mode, allowing local users to gain privileges via a crafted application. This could enable an attacker to run code with elevated privileges, execute arbitrary code, and take complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Recommendations: For Microsoft Windows 2000 SP4, consider applying a patch to fix the kernel memory corruption issue. For Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, apply a patch to address the improper validation of input passed from user mode to the kernel. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions 2000 SP4 through Vista SP1 Microsoft Windows Server versions 2003 SP1 through 2008 **Description** The issue is related to improper input validation in the Windows kernel, allowing local users to execute arbitrary code. This could enable an attacker to run code with elevated privileges, potentially leading to complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. One affected function is `NtUserFnOUTSTRING` in `win32k.sys`. **Recommendations** For Microsoft Windows versions 2000 SP4 through Vista SP1, consider disabling the `NtUserFnOUTSTRING` function in `win32k.sys` as a temporary workaround until a patch is available. For Microsoft Windows Server versions 2003 SP1 through 2008, restrict access to the kernel to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows XP with Active Directory Application Mode (ADAM) **Description** The issue allows remote attackers to cause a denial of service, resulting in the system hanging and restarting, via a crafted LDAP request to Active Directory or Active Directory Application Mode (ADAM). **Recommendations** For Microsoft Windows 2000, update to a version that includes the fix for this issue. For Microsoft Windows Server 2003, update to a version that includes the fix for this issue. For Microsoft Windows XP with Active Directory Application Mode (ADAM), update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the LDAP endpoint to minimize the risk of exploitation.