CVE-2010-2739: Buffer Overflow
First published: Tue Sep 07 2010(Updated: )
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows Server 2003 | =r2 | |
| Microsoft Windows 7 | ||
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Vista | =sp1 | |
| Microsoft Windows XP | =sp3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.ragestorm.net/blogs/?p=255
- http://www.vupen.com/english/advisories/2010/2029
- http://blogs.technet.com/b/msrc/archive/2010/08/10/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability.aspx
- http://secunia.com/advisories/40870
- https://msrc.microsoft.com/blog/2010/08/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability/
Frequently Asked Questions
What is the severity of CVE-2010-2739?
CVE-2010-2739 is classified as a critical vulnerability that can lead to denial of service and possibly arbitrary code execution.
How do I fix CVE-2010-2739?
To fix CVE-2010-2739, ensure that your Microsoft Windows operating system is updated with the latest security patches provided by Microsoft.
Which Windows versions are affected by CVE-2010-2739?
CVE-2010-2739 affects Windows XP SP3, Windows Vista SP1, Windows 7, Windows Server 2003 R2 SP2, and Windows Server 2008 SP2.
What type of attack does CVE-2010-2739 enable?
CVE-2010-2739 can be exploited to perform a denial of service attack, potentially allowing an attacker to execute arbitrary code.
Who can exploit CVE-2010-2739?
CVE-2010-2739 can be exploited by local users through crafted clipboard operations.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-index
- vendor/microsoft
- canonical/microsoft windows server 2003
- version/microsoft windows server 2003/r2
- canonical/microsoft windows 7
- canonical/microsoft windows server
- version/microsoft windows server/sp2
- canonical/microsoft windows vista
- version/microsoft windows vista/sp1
- canonical/microsoft windows xp
- version/microsoft windows xp/sp3