Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

1) An error in the way GDI (Graphics Device Interface) handles integer calculations when processing image file headers can be exploited to cause a heap-based buffer overflow via an EMF or WMF image file with specially crafted header values (e.g. colour depth).

2) A boundary error in GDI when handling filename parameters in EMF files can be exploited to cause a stack-based buffer overflow via a specially crafted EMF file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) The vendor credits:
* Jun Mao, iDefense Labs.
* Sebastian Apelt, reported via Zero Day Initiative.
* Thomas Garnier, SkyRecon.

2) Yamata Li

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS08-021 (KB948590):
http://www.microsoft.com/technet/security/Bulletin/MS08-021.mspx

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=681
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=682

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-08-020/

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers