• News
• Infocus
• Foundations
• Microsoft
• Unix
• IDS
• Incidents
• Virus
• Pen-Test
• Firewalls
• Columnists
• Mailing Lists
• Newsletters
• Bugtraq
• Focus on IDS
• Focus on Linux
• Focus on Microsoft
• Forensics
• Pen-test
• Security Basics
• Vuln Dev
• Vulnerabilities
• Jobs
• Job Opportunities
• Resumes
• Job Seekers
• Employers
• Tools
• RSS
• News
• Vulns
• Security Research

• info
• discussion
• exploit
• solution
• references

Microsoft GDI+ VML Heap-Based Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

Microsoft Windows Vista Home Premium 64-bit edition 0

• Microsoft Security Update for Windows Vista for x64-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa47d016-f5c9 -4586-8876-f1f4f255f54d&displaylang=en

Microsoft Digital Image Suite 2006

• Microsoft Vulnerabilities in Digital Image 2006 using GDI+ Could Allow Remote Code Execution (KB955992)
  http://www.microsoft.com/downloads/details.aspx?familyid=04afd760-8173 -4069-9e82-d3bf053d9eae&displaylang=en

Microsoft SQL Server 2005 Itanium Edition SP2

• Microsoft Security Update for SQL Server 2005 QFE Service Pack 2 (KB954607)
  http://www.microsoft.com/downloads/details.aspx?familyid=5148B887-F323 -4ADB-9721-61E1C0CFD213&displaylang=en


• Microsoft Security Update for SQL Server 2005 Service Pack 2 (KB954606)
  http://www.microsoft.com/downloads/details.aspx?familyid=4603C722-2468 -4ADB-B945-2ED0458B8F47&displaylang=en

Microsoft Report Viewer 2005 SP1

• Microsoft Microsoft Report Viewer Redistributable 2005 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?familyid=82833F27-081D -4B72-83EF-2836360A904D&displaylang=en

Microsoft Windows Server 2003 Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=14e99f8a-cdd4 -40d7-8cfc-73ae6bd6dfad&displaylang=en

Microsoft Office XP SP1

• Microsoft Security Update for Microsoft Office XP (KB953405)
  http://www.microsoft.com/downloads/details.aspx?familyid=ef3de64c-fc17 -4500-9da4-a3bba97fda6d&displaylang=en


• Microsoft Security Update for Microsoft Office XP (KB953405)
  http://www.microsoft.com/downloads/details.aspx?familyid=ef3de64c-fc17 -4500-9da4-a3bba97fda6d

Microsoft Windows Vista Home Basic SP1

• Microsoft Security Update for Windows Vista (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=16f3ad21-ed77 -4c32-93df-3b650b2b32a5&displaylang=en

Microsoft Windows Vista Home Premium 64-bit edition SP1

• Microsoft Security Update for Windows Vista for x64-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa47d016-f5c9 -4586-8876-f1f4f255f54d&displaylang=en

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

Microsoft Windows Vista Enterprise

• Microsoft Security Update for Windows Vista (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=16f3ad21-ed77 -4c32-93df-3b650b2b32a5&displaylang=en

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security Update for Windows XP x64 Edition (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=c5d26771-1f49 -4bbf-902c-bf92e527cadb&displaylang=en

Microsoft Internet Explorer 6.0 SP1

• Microsoft Security Update for Windows 2000 (KB938464) - English
  http://www.microsoft.com/downloads/details.aspx?FamilyId=a860d2d9-653d -4ddb-bbff-323d3ccdb866&displaylang=en

Microsoft Windows Vista Ultimate 64-bit edition SP1

• Microsoft Security Update for Windows Vista for x64-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa47d016-f5c9 -4586-8876-f1f4f255f54d&displaylang=en

Microsoft Visio 2002 SP2

• Microsoft Security Update for Visio 2002 (KB954479)
  http://www.microsoft.com/downloads/details.aspx?familyid=a6d9d3ef-f087 -4f61-9ec1-522b7d4b9c48&displaylang=en

Microsoft Windows Server 2003 Standard Edition

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

Microsoft Windows Vista x64 Edition SP1

• Microsoft Security Update for Windows Vista for x64-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=aa47d016-f5c9 -4586-8876-f1f4f255f54d&displaylang=en

Microsoft SQL Server 2000 Reporting Services SP2

• Microsoft Security Update for SQL Server Reporting Services 2000 Service Pack 2 (KB954609)
  http://www.microsoft.com/downloads/details.aspx?familyid=5F9E7F78-7439 -414B-A9DC-A779B89427DB

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=93f1451b-5b62 -47e5-8f0c-b720b957999a&displaylang=en


• Microsoft Security Update for Windows XP x64 Edition (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=c5d26771-1f49 -4bbf-902c-bf92e527cadb&displaylang=en

Microsoft Windows XP Professional

• Microsoft Security Update for Windows XP (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=e0bd6fbe-f46e -4961-9a79-49ec77d39439&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=14e99f8a-cdd4 -40d7-8cfc-73ae6bd6dfad&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

Microsoft Windows Server 2008 for x64-based Systems 0

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=7f1e0f05-6c9d -4ad1-9b19-50ee4fa7bd7e&displaylang=en

Microsoft Office 2003 0

• Microsoft Security Update for Office 2003 (KB954478)
  http://www.microsoft.com/downloads/details.aspx?familyid=e9f8e309-d721 -4bab-b485-5eede8d49eb8&displaylang=en

Microsoft Windows Vista Home Basic

• Microsoft Security Update for Windows Vista (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=16f3ad21-ed77 -4c32-93df-3b650b2b32a5&displaylang=en

Microsoft Office 2007 SP1

• Microsoft Security Update for Office 2007 (KB954326)
  http://www.microsoft.com/downloads/details.aspx?familyid=4b656fe8-6253 -490c-a81a-e4e8f0bb58d2&displaylang=en

Microsoft Office Compatibility Pack 2007 SP1

• Microsoft Security Update for Office 2007 (KB954326)
  http://www.microsoft.com/downloads/details.aspx?familyid=4b656fe8-6253 -490c-a81a-e4e8f0bb58d2&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

Microsoft Office 2003 SP3

• Microsoft Security Update for Office 2003 (KB954478)
  http://www.microsoft.com/downloads/details.aspx?familyid=e9f8e309-d721 -4bab-b485-5eede8d49eb8&displaylang=en

Microsoft Windows Vista Ultimate

• Microsoft Security Update for Windows Vista (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=16f3ad21-ed77 -4c32-93df-3b650b2b32a5&displaylang=en

Microsoft Windows Vista Home Premium SP1

• Microsoft Security Update for Windows Vista (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=16f3ad21-ed77 -4c32-93df-3b650b2b32a5&displaylang=en

Microsoft Office Compatibility Pack 2007 0

• Microsoft Security Update for Office 2007 (KB954326)
  http://www.microsoft.com/downloads/details.aspx?familyid=4b656fe8-6253 -490c-a81a-e4e8f0bb58d2&displaylang=en

Microsoft Forefront Client Security 1.0

• Microsoft Microsoft Forefront Security v 1.0 MS08-052 (KB 957177)
  http://www.microsoft.com/downloads/details.aspx?familyid=1EB1A79F-44CA -499E-90BB-AC51894E9D1E&displaylang=en

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

3DM Software Disk Management Software SP1

• Microsoft Security Update for Windows Server 2003 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=ac03f138-eca4 -46e1-9782-e811820e547f&displaylang=en

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=14e99f8a-cdd4 -40d7-8cfc-73ae6bd6dfad&displaylang=en

Microsoft Windows Server 2008 Standard Edition 0

• Microsoft Security Update for Windows Server 2008 (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=23bd3be5-cc66 -46f8-9420-49d65d8afe1d&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft Security Update for Windows XP (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=e0bd6fbe-f46e -4961-9a79-49ec77d39439&displaylang=en

Microsoft Windows XP Professional x64 Edition

• Microsoft Security Update for Windows XP x64 Edition (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=c5d26771-1f49 -4bbf-902c-bf92e527cadb&displaylang=en

Microsoft Office XP SP2

• Microsoft Security Update for Microsoft Office XP (KB953405)
  http://www.microsoft.com/downloads/details.aspx?familyid=ef3de64c-fc17 -4500-9da4-a3bba97fda6d&displaylang=en


• Microsoft Security Update for Microsoft Office XP (KB953405)
  http://www.microsoft.com/downloads/details.aspx?familyid=ef3de64c-fc17 -4500-9da4-a3bba97fda6d

Microsoft Windows Server 2008 for Itanium-based Systems 0

• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB938464)
  http://www.microsoft.com/downloads/details.aspx?familyid=5159bdba-3825 -4816-a2be-ab035332b9e2&displaylang=en