Description
Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based buffer overflow.
References
- 1094 third-party-advisory
- ADV-2006-2324 vdb-entry
- 26431 vdb-entry
- TA06-164A third-party-advisory
- 20631 third-party-advisory
- 20060613 SYMSA-2006-004: Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution mailing-list
- MS06-026 vendor-advisory
- win-gre-wmf-code-execution(26815) vdb-entry
- 1016286 vdb-entry
- VU#909508 third-party-advisory
- 18322 vdb-entry