Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges.

1) An error in the "RtlQueryRegistryValues()" function can be exploited to cause a buffer overflow when e.g. called by the "GreEnableEUDC()" function in win32k.sys to copy a specially crafted "SystemDefaultEUDCFont" registry value.

2) A type conversion error in the kernel's support for Trace Events may result in an insufficiently sized buffer being allocated for userspace data, which can be exploited to cause a buffer overflow.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) noobpwnftw
2) std_logic via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS11-011 (KB2393802):
http://www.microsoft.com/technet/security/bulletin/ms11-011.mspx

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-064/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers