CVE-2008-1083

HIGH 8.1CVE-2008-1083 · Published 08/04/2008 · updated 16/06/2026

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."

References

archives.neohapsis.com/archives/fulldisclosure/2008-04/0168.html · Broken Link
labs.idefense.com/intelligence/vulnerabilities/display.php · Third Party Advisory
marc.info · Mailing List
secunia.com/advisories/29704 · Patch
support.microsoft.com/kb/948590 · Vendor Advisory
kb.cert.org/vuls/id/632963 · US Government Resource
osvdb.org/44213 · Broken Link
osvdb.org/44214 · Broken Link
securityfocus.com/archive/1/490584/100/0/threaded
securityfocus.com/bid/28571 · Third Party Advisory
securityfocus.com/bid/30933 · Third Party Advisory
securitytracker.com/id · Third Party Advisory
us-cert.gov/cas/techalerts/TA08-099A.html · US Government Resource
vupen.com/english/advisories/2008/1145/references · Broken Link
zerodayinitiative.com/advisories/ZDI-08-020 · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-021
exchange.xforce.ibmcloud.com/vulnerabilities/41471
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5441
exploit-db.com/exploits/5442
exploit-db.com/exploits/6330

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free