Microsoft GDI + image vulnerability details

Microsoft GDI + image vulnerability details

What is GDI +:
GDI + is a graphical device interface that provides two-dimensional vector graphics, images, and la s for applications and programmers.

Vulnerability impact:
The GDI + Library (GdiPlus. dll) used in Microsoft products provides access to various graphical methods through class-based APIs.
The GDI + Library has the integer overflow vulnerability when parsing specially crafted BMP files. If the file contains malformed BitMapInfoHeader, it will cause incorrect integer calculation, this eventually triggers memory corruption that can be exploited. Attackers who successfully exploit this vulnerability can completely control the affected system. These vulnerabilities may allow remote code execution if users use affected software to view specially crafted image files or browse websites containing specially crafted content.
Attackers can then install programs, view, change, or delete data, or create new accounts with full user permissions. Users with fewer system user permissions configured for accounts are less affected than users with administrative user permissions.

Affected image formats:
This gdi + vulnerability is very serious, similar to the previous cursor vulnerability and wmf vulnerability, and involves a wider range of formats (BMP wmfgifemfvml)

Microsoft's recommendation for third-party applications:
★I am a third-party application developer and my applications use gdiplus. dll. Is my application vulnerable to attacks? How can I update it?
Redistributing gdiplus. dll developers should ensure that they update the gdiplus. dll version installed with their applications by downloading the updates provided in this announcement. Developers are encouraged to perform operations according to the recommended best solution using shared components. For more information about best practices for using shared components, see article 835322 on the Microsoft Knowledge Base for independent applications.

★I am developing software that contains the redistributable file gdiplus. dll. What should I do?
You shall install the security updates provided in this announcement for your development software. If gdiplus has been re-distributed with your application. dll, you should use the updated version of this file obtained when downloading this Security Update for your development software to release the updated version of your application to your customers.

★If third-party applications use or install the affected gdiplus. dll components, are all required Microsoft Security Updates still vulnerable to attacks?
No, this security update replaces and re-registers the affected components provided with the operating system. If third-party applications follow the recommended best solution and share components as parallel components, they will not be affected. If a third-party application does not follow the recommended best solution but resends the old version of gdiplus. dll along with its application, the customer may be threatened. Microsoft Knowledge Base Article 954593 also contains instructions for manually checking registered affected OLE components. Encourage customers to contact third-party solution developers for additional information