SB2007040301 - Multiple privilege escalation vulnerabilities in Microsoft Windows
Published: April 3, 2007 Updated: December 18, 2016
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Privilege escalation (CVE-ID: CVE-2007-1213)
The vulnerability allows a local attacker to obtain elevated privileges on vulnerable system.
The vulnerability exists in the TrueType Fonts rasterizer when processing specially crafted fonts. A local user can create a specially crafted font file, call an uninitialized function pointer and execute arbitrary code on vulnerable system with elevated privileges.
Successful exploitation of this vulnerability may allow a local user to obtain full access to vulnerable system.
2) Privilege escalation (CVE-ID: CVE-2007-1215)
The vulnerability allows a local attacker to obtain elevated privileges on vulnerable system.
The vulnerability exists in Graphics Rendering Engine when processing certain color-related parameters. A local user create a specially crafted image file and execute arbitrary code on vulnerable system with elevated privileges.
Successful exploitation of this vulnerability may allow a local user to obtain full access to vulnerable system.
3) Privilege escalation (CVE-ID: CVE-2006-5586)
The vulnerability allows a local attacker to obtain elevated privileges on vulnerable system.
The vulnerability exists in Graphics Rendering Engine when processing layered application windows. A local user can execute arbitrary code on vulnerable system with elevated privileges.
Successful exploitation of this vulnerability may allow a local user to obtain full access to vulnerable system.
4) Privilege escalation (CVE-ID: CVE-2007-1212)
The vulnerability allows a local attacker to obtain elevated privileges on vulnerable system.
The vulnerability exists in Graphics Rendering Engine when processing Enhanced Metafile (EMF) image format files. A local user create a specially crafted EMF file and execute arbitrary code on vulnerable system with elevated privileges.
Successful exploitation of this vulnerability may allow a local user to obtain full access to vulnerable system.
5) Privilege escalation (CVE-ID: CVE-2006-5758)
The vulnerability allows a local attacker to obtain elevated privileges on vulnerable system.
The vulnerability exists in Graphics Rendering Engine when processing WMF and EMF files. A local user create a specially crafted WMF or EMF file and execute arbitrary code on vulnerable system with elevated privileges.
Successful exploitation of this vulnerability may allow a local user to obtain full access to vulnerable system.
Remediation
Install update from vendor's website.