Microsoft Patches Windows Security Vulnerability

Microsoft released a single Windows security bulletin for its first Patch Tuesday update of the year.

The bulletin is rated critical for users of Windows 2000 Service Pack 4, and low for several other editions of Windows. The vulnerability at issue lies within the Microsoft Windows Embedded OpenType (EOT) Font Engine, and is due to the way it decompresses specially crafted EOT fonts. If an attacker can trick a user into viewing content rendered in EOT font, the vulnerability could be exploited to permit remote code execution, Microsoft said.

“The lone Microsoft vulnerability affects everything from Windows 2000 to Windows 7, but is only rated critical for Windows 2000,” said Ben Greenbaum, senior research manager at Symantec Security Response, in a statement. “From XP SP2 onward, Microsoft hardened heap memory with heap memory protection strategies; this makes the vulnerability less of an issue for the later systems.”