Multiple vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system.

1) An error within the handling of GDI kernel structures allows the created global shared memory section, which is mapped with read-only permissions, to be re-mapped with read-write permissions. This can be exploited to corrupt memory by overwriting the data structures with arbitrary data.

2) An error within the processing of Windows Metafile (WMF) image format files can be exploited to cause a system to stop responding or crash when viewing a malicious WMF file.

3) A boundary error within the processing of Enhanced Metafile (EMF) image format files can be exploited to execute arbitrary code on a system via any application rendering EMF files.

4) An error in the Graphics Rendering Engine when rendering layered application windows with invalid window sizes can be exploited to execute arbitrary code with escalated privileges.

5) An error in the Graphics Device Interface when processing colour-related parameters can be exploited to execute arbitrary code with escalated privileges.

6) An error in the TrueType Fonts rasterizer when handling defective or modified font types may be exploited to execute arbitrary code via a specially crafted font type.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Cesar Cerrudo, Argeniss.
2) Greg MacManus, iDefense Labs.
3) The vendor credits Shaun Colley, NGS Software.
4) Reported by the vendor.
5) The vendor credits Sergey Svinolobov.
6) The vendor credits Thomas Phinney, Adobe Systems.

Changelog
Further details available in Customer Area

Original Advisory
MS07-017 (KB925902):
http://www.microsoft.com/technet/security/Bulletin/MS07-017.mspx

Argeniss:
http://www.argeniss.com/research/ARGENISS-ADV-110604.txt

MOKB:
http://projects.info-pull.com/mokb/MOKB-06-11-2006.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=499

Deep Links
Links available in Customer Area