Vulnerability Description
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 2003 Server | All versions |
| Microsoft | Windows 7 | All versions |
| Microsoft | Windows Server 2003 | All versions |
| Microsoft | Windows Server 2008 | - |
| Microsoft | Windows Vista | All versions |
| Microsoft | Windows Xp | All versions |
Related Weaknesses (CWE)
References
- http://blogs.technet.com/b/msrc/archive/2010/08/10/update-on-the-publicly-discloVendor Advisory
- http://secunia.com/advisories/40870Vendor Advisory
- http://www.ragestorm.net/blogs/?p=255Exploit
- http://www.vupen.com/english/advisories/2010/2029Vendor Advisory
- https://msrc.microsoft.com/blog/2010/08/update-on-the-publicly-disclosed-win32k-
- http://blogs.technet.com/b/msrc/archive/2010/08/10/update-on-the-publicly-discloVendor Advisory
- http://secunia.com/advisories/40870Vendor Advisory
- http://www.ragestorm.net/blogs/?p=255Exploit
- http://www.vupen.com/english/advisories/2010/2029Vendor Advisory
- https://msrc.microsoft.com/blog/2010/08/update-on-the-publicly-disclosed-win32k-
FAQ
What is CVE-2010-2739?
CVE-2010-2739 is a vulnerability with a CVSS score of 7.2 (HIGH). Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to caus...
How severe is CVE-2010-2739?
CVE-2010-2739 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-2739?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows 2003 Server, Microsoft Windows 7, Microsoft Windows Server 2003, Microsoft Windows Server 2008, Microsoft Windows Vista.