Launch Printer Friendly Page Security TechCenter > Security Bulletins > Microsoft Security Bulletin MS08-052

Microsoft Security Bulletin MS08-052 - Critical

Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593)

Published: | Updated:

Version: 4.0

General Information

Executive Summary

This security update resolves several privately reported vulnerabilities in Microsoft Windows GDI+. These vulnerabilities could allow remote code execution if a user viewed a specially crafted image file using affected software or browsed a Web site that contains specially crafted content. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for all supported editions of Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008, Microsoft Internet Explorer 6 Service Pack 1 when installed on Microsoft Windows 2000 Service Pack 4, Microsoft Digital Image Suite 2006, SQL Server 2000 Reporting Services Service Pack 2, all supported editions of SQL Server 2005, Microsoft Report Viewer 2005 Service Pack 1 Redistributable Package, and Microsoft Report Viewer 2008 Redistributable Package.

This security update is rated Important for all supported editions of Microsoft Office XP; Microsoft Office 2003; all affected Office Viewer software for Microsoft Office 2003; 2007 Microsoft Office System; all affected Office Viewer software for 2007 Microsoft Office System; Microsoft Office Compatibility Pack, Microsoft Expression Web, Microsoft Expression Web 2, Microsoft Office Groove 2007 and Microsoft Office Groove 2007 Service Pack 1; Microsoft Office Project 2002; Microsoft Visio 2002; Microsoft Office PowerPoint Viewer 2003; Microsoft Works 8; and Microsoft Forefront Client Security 1.0. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerabilities by modifying the way that GDI+ handles viewing malformed images. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

Recommendation. Microsoft recommends that customers apply the update immediately.

Known Issues. Microsoft Knowledge Base Article 954593 documents the currently known issues that customers may experience when installing this security update. The article also documents recommended solutions for these issues.

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

Affected Software

Windows Operating System and Components

Operating SystemComponentMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Operating Systems
Windows XP Service Pack 2 and Windows XP Service Pack 3Not applicableRemote Code ExecutionCriticalNone
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2Not applicableRemote Code ExecutionCriticalNone
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2Not applicableRemote Code ExecutionCriticalNone
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2Not applicableRemote Code ExecutionCriticalNone
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based SystemsNot applicableRemote Code ExecutionCriticalNone
Windows Vista and Windows Vista Service Pack 1Not applicableRemote Code ExecutionCriticalNone
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1Not applicableRemote Code ExecutionCriticalNone
Windows Server 2008 for 32-bit Systems*Not applicableRemote Code ExecutionCriticalNone
Windows Server 2008 for x64-based Systems*Not applicableRemote Code ExecutionCriticalNone
Windows Server 2008 for Itanium-based SystemsNot applicableRemote Code ExecutionCriticalNone
Internet Explorer 6
Microsoft Windows 2000 Service Pack 4Microsoft Internet Explorer 6 Service Pack 1
(KB938464)
Remote Code ExecutionCriticalMS07-050
Microsoft .NET Framework
Microsoft Windows 2000 Service Pack 4Microsoft .NET Framework 1.0 Service Pack 3
(KB947739)

Microsoft .NET Framework 1.1 Service Pack 1
(KB947742)

Microsoft .NET Framework 2.0
(KB947746)

Microsoft .NET Framework 2.0 Service Pack 1
(KB947748)
NoneNoneNone

*Windows Server 2008 Server Core installation not affected. The vulnerabilities addressed by this update do not affect supported editions of Windows Server 2008 if Windows Server 2008 was installed using the Server Core installation option, even though the files affected by these vulnerabilities may be present on the system. However, users with the affected files will still be offered this update because the update files are newer (with higher version numbers) than the files that are currently on your system. For more information on this installation option, see Server Core. Note that the Server Core installation option does not apply to certain editions of Windows Server 2008; see Compare Server Core Installation Options.

Microsoft Office

Office Suite and Other SoftwareMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Microsoft Office Suites
Microsoft Office XP Service Pack 3
(KB953405)
Remote Code ExecutionImportantMS08-016
Microsoft Office 2003 Service Pack 2
(KB954478)
Remote Code ExecutionImportantNone
Microsoft Office 2003 Service Pack 3
(KB954478)
Remote Code ExecutionImportantNone
2007 Microsoft Office System
(KB954326)
Remote Code ExecutionImportantNone
2007 Microsoft Office System Service Pack 1
(KB954326)
Remote Code ExecutionImportantNone
Other Office Software
Microsoft Office Project 2002 Service Pack 1
(KB953405)*
Remote Code ExecutionImportantMS08-016
Microsoft Visio 2002 Service Pack 2
(KB954479)
Remote Code ExecutionImportantMS07-015
Microsoft Office Word Viewer, Microsoft Word Viewer 2003, Microsoft Word Viewer 2003 Service Pack 3, Microsoft Office Excel Viewer 2003, Microsoft Office Excel Viewer 2003 Service Pack 3
(KB954478)**
Remote Code ExecutionImportantNone
Microsoft Office PowerPoint Viewer 2003
(KB956500)
Remote Code ExecutionImportantMS08-051
Microsoft Office Excel Viewer, Microsoft Office PowerPoint Viewer 2007, Microsoft Office PowerPoint Viewer 2007 Service Pack 1
(KB954326)***
Remote Code ExecutionImportantNone
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1
(KB954326)***
Remote Code ExecutionImportantNone
Microsoft Expression Web and Microsoft Expression Web 2
(KB954326)***
Remote Code ExecutionImportantNone
Microsoft Office Groove 2007 and Microsoft Office Groove 2007 Service Pack 1
(KB954326)***
Remote Code ExecutionImportantNone
Microsoft Works 8
(KB956483)
Remote Code ExecutionImportantMS08-044
Microsoft Digital Image Suite 2006
(KB955992)
Remote Code ExecutionCriticalNone

*The update for this affected software is the same as the update for Microsoft Office XP Service Pack 3.

**The update for these affected software is the same as the update for Microsoft Office 2003 Service Pack 2 and Microsoft Office 2003 Service Pack 3.

***The update for these affected software is the same as the update for 2007 Microsoft Office System and 2007 Microsoft Office System Service Pack 1.

Note Office Communicator 2005 and Office Communicator 2007 distribute a copy of gdiplus.dll that contains the affected code. However, Microsoft's analysis has shown that there are no reliable attack vectors exposed in these products.

Microsoft SQL Server

Depending on your software version or edition, you may need to choose between GDR and QFE software update links below in order to manually install your update from the Microsoft Download Center. For more information on determining which update to install on your system, see the Frequently Asked Questions (FAQ) Related to This Security Update subsection, in this section.

GDR Software UpdatesQFE Software UpdatesMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Not applicableSQL Server 2000 Reporting Services Service Pack 2
(KB954609)
Remote Code ExecutionCriticalNone
SQL Server 2005 Service Pack 2
(KB954606)
SQL Server 2005 Service Pack 2
(KB954607)
Remote Code ExecutionCriticalMS08-040
SQL Server 2005 x64 Edition Service Pack 2
(KB954606)
SQL Server 2005 x64 Edition Service Pack 2
(KB954607)
Remote Code ExecutionCriticalMS08-040
SQL Server 2005 for Itanium-based Systems Service Pack 2
(KB954606)
SQL Server 2005 for Itanium-based Systems Service Pack 2
(KB954607)
Remote Code ExecutionCriticalMS08-040

Note Cumulative update package 9 for SQL Server 2005 Service Pack 2 (953752) also contains hotfixes for these vulnerabilities. Customers who have previously installed Cumulative update package 9 for SQL Server 2005 Service Pack 2 (953752) do not need to install the QFE Software Update for SQL Server 2005 Service Pack 2 (954607).

Developer Tools

SoftwareMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Microsoft Visual Studio .NET 2002 Service Pack 1
(KB947736)
NoneNoneNone
Microsoft Visual Studio .NET 2003 Service Pack 1
(KB947737)
NoneNoneNone
Microsoft Visual Studio 2005 Service Pack 1
(KB947738)
NoneNoneNone
Microsoft Visual Studio 2008
(KB952241)
NoneNoneNone
Microsoft Report Viewer 2005 Service Pack 1 Redistributable Package
(KB954765)
Remote Code ExecutionCriticalNone
Microsoft Report Viewer 2008 Redistributable Package
(KB954766)
Remote Code ExecutionCriticalNone
Microsoft Visual FoxPro 8.0 Service Pack 1 when installed on Microsoft Windows 2000 Service Pack 4
(KB955368)
NoneNoneNone
Microsoft Visual FoxPro 9.0 Service Pack 1 when installed on Microsoft Windows 2000 Service Pack 4
(KB955369)
NoneNoneNone
Microsoft Visual FoxPro 9.0 Service Pack 2 when installed on Microsoft Windows 2000 Service Pack 4
(KB955370)
NoneNoneNone
Microsoft Platform SDK Redistributable: GDI+NoneNoneMS04-028

Security Software

SoftwareMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Microsoft Forefront Client Security 1.0 when installed on Microsoft Windows 2000 Service Pack 4
(KB957177)
Remote Code ExecutionImportantNone

Non-Affected Software

SoftwareComponent
Operating Systems and Components
Microsoft Windows 2000 Service Pack 4
Microsoft Windows 2000 Service Pack 4Microsoft Internet Explorer 5.01 Service Pack 4
Windows Messenger 5.1
Windows XP Service Pack 2 and Windows XP Service Pack 3Microsoft Internet Explorer 6
Windows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Messenger 5.1
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2Microsoft Internet Explorer 6
Windows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Messenger 5.1
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2Microsoft Internet Explorer 6
Windows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Messenger 5.1
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2Microsoft Internet Explorer 6
Windows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Messenger 5.1
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based SystemsMicrosoft Internet Explorer 6
Windows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Vista and Windows Vista Service Pack 1Windows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1Windows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Server 2008 for 32-bit SystemsWindows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Server 2008 for x64-based SystemsWindows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Windows Server 2008 for Itanium-based SystemsWindows Internet Explorer 7
Microsoft .NET Framework 1.0 Service Pack 3
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 Service Pack 1
Windows Messenger 4.7
Microsoft Office Suites
Microsoft Office 2000 Service Pack 3
Other Office Software
Microsoft Visio 2003 Viewer
Microsoft Visio 2007 Viewer and Microsoft Visio 2007 Viewer Service Pack 1
Microsoft Office SharePoint Server 2007
Microsoft Office SharePoint Server 2007 Service Pack 1
Microsoft Works 9.0
Microsoft Works Suite 2005
Microsoft Works Suite 2006
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac
Microsoft SQL Server
SQL Server 7.0 Service Pack 4
SQL Server 2000 Service Pack 4
SQL Server 2000 Itanium-based Edition Service Pack 4
Microsoft Data Engine (MSDE) 1.0
Microsoft SQL Server 2000 Desktop Engine (MSDE 2000)
Microsoft SQL Server 2005 Express Edition Service Pack 2

Frequently Asked Questions (FAQ) Related to This Security Update

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

GDI+ VML Buffer Overrun Vulnerability - CVE-2007-5348

GDI+ EMF Memory Corruption Vulnerability - CVE-2008-3012

GDI+ GIF Parsing Vulnerability - CVE-2008-3013

GDI+ WMF Buffer Overrun Vulnerability - CVE-2008-3014

GDI+ BMP Integer Overflow Vulnerability - CVE-2008-3015

Update Information

Detection and Deployment Tools and Guidance

Security Update Deployment

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

Support

  • Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
  • International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (September 9, 2008): Bulletin published.
  • V2.0 (September 12, 2008): Bulletin updated to add Microsoft Office Project 2002 Service Pack 2, all Office Viewer software for Microsoft Office 2003, and all Office Viewer software for 2007 Microsoft Office System as Affected Software. Details for this bulletin revision are provided in the "Why was this bulletin revised on September 12, 2008?" entry in the Frequently Asked Questions (FAQ) Related to this Security Update section.
  • V2.1 (September 17, 2008): Changed references to Microsoft Office Project 2002 Service Pack 2 as affected software to Microsoft Office Project 2002 Service Pack 1. This is a name change only. There were no changes to the binaries or detection.
  • V2.2 (October 29, 2008): Added an FAQ entry concerning a printing issue with Microsoft SQL Server 2005 Reporting Services and removed Visio Viewer from Affected Software, including other minor changes. For more details, please see the entry in the Frequently Asked Questions (FAQ) Related to this Security Update section.
  • V3.0 (December 9, 2008): Added Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1, Microsoft Expression Web and Microsoft Expression Web 2, and Microsoft Office Groove 2007 and Microsoft Office Groove 2007 Service Pack 1 as Affected Software. Also detailed a detection change for Microsoft SQL Server 2005 Service Pack 2 in the "Why was this bulletin revised on December 9, 2008?" entry in the Frequently Asked Questions (FAQ) Related to this Security Update section.
  • V4.0 (March 10, 2009): Added entry in the Frequently Asked Questions (FAQ) Related to this Security Update section to communicate the rerelease of the update packages for Windows XP Service Pack 3 and Windows Server 2003 Service Pack 2 to fix an installation issue. Customers who have already successfully installed the original updates for Windows XP Service Pack 3 or Windows Server 2003 Service Pack 2 do not need to reinstall the new updates.