CVE:CVE-2010-0819
CNNVD:CNNVD-201006-079
Windows是微软发布的非常流行的操作系统。
Windows OpenType CFF驱动没有正确地验证用户态传送给内核态的某些数据，如果用户查看了特制CCF字体所渲染的内容，在获得字型轮廓时就会用任意数量的0字节覆盖内核内存，导致内核级权限提升。攻击者必须拥有有效的登录凭据且能够本地登录才可以利用这个漏洞，无法远程或匿名利用。
solution:Upgrade microsoft windows_2000 to a higher version than *:sp4,and avoid the version *:sp4; Upgrade microsoft windows_xp to a higher version than *:sp2,*:sp3,-:sp2,and avoid the version *:sp2,*:sp3,-:sp2; Upgrade microsoft windows_2003_server to a higher version than *:sp2,and avoid the version *:sp2; Upgrade microsoft windows_vista to a higher version than *:sp1,*:sp2,-:sp1,-:sp2,and avoid the version *:sp1,*:sp2,-:sp1,-:sp2; Upgrade microsoft windows_server_2008 to a higher version than *,*:sp2,-:sp2,r2,and avoid the version *:sp2,-:sp2,r2; Upgrade microsoft windows_7 to a higher version than -