|
|
|
|
| |
Credit:
The information has been provided by Yamata Li, Thomas Garnier, Wushi, Ivan Fratric,Tavis Ormandy, Marsu Pilami, Carsten H. Eiram and Microsoft .
The original article can be found at: http://www.microsoft.com/technet/security/bulletin/ms09-062.mspx
|
| |
Vulnerable Systems:
* Microsoft GDI+
The security update addresses the vulnerabilities by introducing proper data validations within GDI+ when rendering WMF images, modifying the way that GDI+ manages a heap buffer when reading a PNG file, modifying the way that GDI+ allocates a buffer used when reading TIFF files, This update modifies the way that GDI+ manages buffers when certain .NET API calls are made, modifying the way that GDI+ calculates the required size of a buffer while parsing a PNG image and modifying the way that Microsoft Office opens specially crafted files.
This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003; Windows Vista and Windows Vista Service Pack 1; Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1; Windows Server 2008 for 32-bit Systems, Windows Server 2008 for x64-based Systems, and Windows Server 2008 for Itanium-based Systems; Microsoft Internet Explorer 6 Service Pack 1 when installed on Microsoft Windows 2000 Service Pack 4, SQL Server 2000 Reporting Services Service Pack 2, all supported editions of SQL Server 2005, Microsoft Report Viewer 2005 Service Pack 1 Redistributable Package, Microsoft Report Viewer 2008 Redistributable Package, and Microsoft Report Viewer 2008 Redistributable Package Service Pack 1.
This security update is rated Important for all supported editions of Microsoft .NET Framework 1.1 and Microsoft .NET Framework 2.0 on Microsoft Windows 2000; Microsoft Office XP; Microsoft Office 2003; all affected Office Viewer software for Microsoft Office 2003; 2007 Microsoft Office System; all affected Office Viewer software for 2007 Microsoft Office System; Microsoft Office Compatibility Pack, Microsoft Expression Web, Microsoft Expression Web 2, Microsoft Office Groove 2007 and Microsoft Office Groove 2007 Service Pack 1; Microsoft Office Project 2002; Microsoft Office Visio 2002; Microsoft Works 8.5; and Microsoft Forefront Client Security 1.0.
CVE Information:
CVE-2009-2500
CVE-2009-2501
CVE-2009-2502
CVE-2009-2503
CVE-2009-2504
CVE-2009-3126
CVE-2009-2528
CVE-2009-2518
|
|
|
|
|
