The Latest Bugs and Naming from our “friends” at Redmond…
CNET is carrying two Microsoft stories today. The first is about unpatched image vulnerabilities in IE SP2. According to the release, four proof of concepts have been released that crash the latest version of internet explorer. The bug release, on security focus, reads:
Microsoft Internet Explorer is prone to a buffer overflow vulnerability in the JPEG image rendering library used by the browser. This issue is due to a failure of the application to properly bounds check input data prior to copying it to a fixed size memory buffer.
This issue was identified by creating random input for the browser, and has not been researched further at this time. This BID will be updated as further information is disclosed.
Successful exploitation may result in execution of arbitrary code in the context of the user executing the affected browser.
As such, it may or may not be exploitable, but it certainly is a bug. The second is advance speculation on the true name of Longhorn:
Rumor has it that Microsoft plans to use Vista as the official name for the next version of Windows, which has been known by its codename, Longhorn.
Personally, I think Windows Vista sounds a bit odd…
This entry was posted on Thursday, July 21st, 2005 at 10:49 pm and is tagged with buffer overflow vulnerability, latest version of internet explorer, memory buffer, random input, security focus, true name, jpeg image, input data, cnet, arbitrary code, next version of windows, codename longhorn, vulnerabilities, sp2, speculation, execution, bugs, crash, proof, failure. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback.
Add New Comment
Viewing 1 Comment
Thanks. Your comment is awaiting approval by a moderator.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Add New Comment
Trackbacks
(Trackback URL)