CVE:CVE-2010-2739
CNNVD:CNNVD-201009-024
Microsoft Windows是微软发布的非常流行的视窗操作系统。
Microsoft Windows XP SP3，Server 2003 R2 Enterprise SP2，Vista Business SP1，Windows 7和Server 2008 SP2的win32k.sys文件中的CreateDIBPalette函数存在缓冲区溢出漏洞。本地用户可以借助执行包含特制位图的剪贴板操作(GetClipboardData API函数)导致拒绝服务(死机)和可能执行任意代码，此位图包含具有大量颜色的调色板。
solution:Upgrade microsoft windows_2003_server to a higher version than *:r2,and avoid the version *:r2; Upgrade microsoft windows_7 to a higher version than *; Upgrade microsoft windows_server_2003 to a higher version than *:sp2,and avoid the version *:sp2; Upgrade microsoft windows_server_2008 to a higher version than -:sp2,and avoid the version -:sp2; Upgrade microsoft windows_vista to a higher version than *:sp1,and avoid the version *:sp1; Upgrade microsoft windows_xp to a higher version than *:sp3,and avoid the version *:sp3