Description
Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.
References
- 20060110 [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability mailing-list
- http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375525
- VU#915930 third-party-advisory
- EEYEB20050801 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm
- 18829 vdb-entry
- ADV-2006-0118 vdb-entry
- 18391 third-party-advisory
- MS06-002 vendor-advisory
- win-embedded-fonts-bo(23922) vdb-entry
- oval:org.mitre.oval:def:698 vdb-entry signature
- oval:org.mitre.oval:def:1185 vdb-entry signature
- oval:org.mitre.oval:def:714 vdb-entry signature
- oval:org.mitre.oval:def:1462 vdb-entry signature
- 1015459 vdb-entry
- 18311 third-party-advisory
- oval:org.mitre.oval:def:1126 vdb-entry signature
- 18365 third-party-advisory
- oval:org.mitre.oval:def:1491 vdb-entry signature
- 20060110 [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability mailing-list
- 16194 vdb-entry
- TA06-010A third-party-advisory