CVE-2011-5046

Description

The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted data, as demonstrated by a large height attribute of an IFRAME element rendered by Safari, aka "GDI Access Violation Vulnerability."

Related CPE's

omicrosoftwindows_xp*sp2******

omicrosoftwindows_server_2008r2*******

omicrosoftwindows_xp*sp3******

omicrosoftwindows_7*sp1x86*****

omicrosoftwindows_server_2008r2sp1******

omicrosoftwindows_server_2003*sp2******

omicrosoftwindows_vista*sp2******

omicrosoftwindows_server_2008*sp2******

References

18275

Exploit

77908

47237

Vendor Advisory

http://twitter.com/w3bd3vil/statuses/148454992989261824

1026450

TA12-045A

US Government Resource

ms-win32k-iframe-code-exec(71873)

oval:org.mitre.oval:def:14603

MS12-008

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version

2.0

VectorString

AV:N/AC:M/Au:N/C:C/I:C/A:C

AccessVector

NETWORK

AccessComplexity

MEDIUM

Authentication

NONE

ConfidentialityImpact

COMPLETE

IntegrityImpact

COMPLETE

AvailabilityImpact

COMPLETE

BaseScore

9.300000190734863

Created by Yello
About Severity.io