Integer underflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a malformed .hlp file, which leads to a heap-based buffer overflow.
| Software | From | Fixed in |
|---|---|---|
| microsoft / windows_nt | 4.0-sp5 | 4.0-sp5.x |
| microsoft / windows_2003_server | web-sp1_beta_1 | web-sp1_beta_1.x |
| microsoft / windows_xp | - | - |
| microsoft / windows_nt | 4.0-sp3 | 4.0-sp3.x |
| microsoft / windows_2003_server | web | web.x |
| microsoft / windows_2003_server | enterprise | enterprise.x |
| microsoft / windows_nt | 4.0-sp6a | 4.0-sp6a.x |
| microsoft / windows_2003_server | enterprise_64-bit | enterprise_64-bit.x |
| microsoft / windows_2003_server | enterprise-sp1_beta_1 | enterprise-sp1_beta_1.x |
| microsoft / windows_2000 | - | - |
| microsoft / windows_nt | 4.0-sp6 | 4.0-sp6.x |
| microsoft / windows_nt | 4.0 | 4.0.x |
| microsoft / windows_nt | 4.0-sp1 | 4.0-sp1.x |
| microsoft / windows_nt | 4.0-sp4 | 4.0-sp4.x |
| microsoft / windows_2003_server | standard-sp1_beta_1 | standard-sp1_beta_1.x |
| microsoft / windows_nt | 4.0-sp2 | 4.0-sp2.x |
| microsoft / windows_2003_server | r2 | r2.x |
| microsoft / windows_2003_server | r2-sp1_beta_1 | r2-sp1_beta_1.x |
| microsoft / windows_2003_server | standard | standard.x |