[German]Security researchers from Google's Projekt Zero has published another zero day vulnerability in Windows that hasn't been patched
Advertising
Mateusz Jurczyk from Google's Project Zero has discovered the vulnerability in Windows GDI library gdi.dll. Jurczyk discovered multiple bugs related to the handling of DIBs (Device Independent Bitmaps) embedded in EMF records, as implemented in the user-mode Windows GDI library (gdi32.dll).
Using a prepared EMF file allows an attacker to read back images from applications like Internet Explorer. My understanding is, that it's a minor bug, but it shall be closed during the next patchday. Google reported the vulnerability on November 17, 2016 to Microsoft. Such vulnerabilities will be disclosed after 90 days – details has been published here.
Advertising
