Vulnerability Note VU#297462

Microsoft Windows Graphics Device Interface (GDI+) is an application programming interface (API) that provides programmers the ability to display information on screens and printers. GDI+ includes the ability to process JPEG image files. There is a buffer overflow vulnerability in the way the JPEG parsing component of GDI+ (Gdiplus.dll) handles malformed JPEG images. By introducing a specially crafted JPEG file to the vulnerable component, a remote attacker could trigger a buffer overflow condition.

Microsoft notes that Windows XP, Windows XP Service Pack 1, and Windows Server 2003 provide the operating system version of the affected component. For backward compatibility, some third-party applications may install their own copy of the affected component. These include Office XP, Visio 2002, Project 2002, Office 2003, Visio 2003, and Project 2003. If any of these applications are installed on your system, you should apply the patch for these applications. If you use Windows XP, Windows XP Service Pack 1, or Windows Server 2003, you must also install the operating system patch.

Please keep in mind, third-party applications, other than those listed above, may install a copy of the affected component. Any application that uses the Gdiplus.dll file to process JPEG image files is vulnerable.

A remote, unauthenticated attacker could potentially execute arbitrary code on a vulnerable system by introducing a specially crafted JPEG file. This malicious JPEG image may be introduced to the system via a malicious web page, HTML email, or an email attachment.

Apply Patch
Apply a patch as described in Microsoft Security Bulletin MS04-028.