Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges and potentially by malicious people to compromise a user's system.

1) An error in the parsing of OTF (OpenType Font) files can be exploited by loading a properly formatted font and then reload it with specially crafted offset and length fields for the head table of the font.

2) A logic error when parsing Unicode BMP (UCS-2) strings in a naming table can be exploited to cause a buffer overflow via a specially crafted OpenType font.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code with kernel privileges. For third-party web browsers natively rendering OpenType Fonts (OTF), this may be exploited remotely when a user visits a web page embedding a specially crafted font.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Diego Juarez, Core Security Technologies.
2) The vendor credits Sebastian Apelt, siberas.

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS10-078 (KB2279986):
http://www.microsoft.com/technet/security/bulletin/ms10-078.mspx

Core Security Technologies:
http://www.coresecurity.com/content/ms-opentype-cff-parsing-vulnerability

Technical Analysis
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers