Security Research & Defense : New EMF gdiplus.dll crash not exploitable for code execution（情報元のブックマーク数）
EMFファイルのGdiplus.dllのExploitに関する詳細がMSから出ています。
Yesterday we noticed a blog post and securityfocus article about a potential new vulnerability in Microsoft GDI+ when parsing a specially-crafted EMF file. You might have heard about it referred to as ‘GpFont.SetData()’. We wanted to address some speculation about this EMF parsing bug.
New EMF gdiplus.dll crash not exploitable for code execution – Security Research & Defense
First, our initial investigation shows that it is not exploitable for code execution. We are still investigating all the potential ways to hit this code but in all the common cases so far, our /GS mitigation is an effective defense-in-depth measure. The EMF parsing bug ends up writing 0x0000, a single Unicode 0 character, over the lower two bytes of the /GS security cookie. Only those two bytes are overwritten and the application is terminated due to the /GS failure.
