Virtual Machine and GDI+ - Tilted Forum Project Discussion Community

eyeronic · 12-10-2004, 09:59 AM

Windows wants me to do these updates, which I assume is a good thing to do. What the heck is the virtual machine. What the heck is GDI+? Should I really install these things? Is there any disadvantage?

bendsley · 12-10-2004, 11:52 AM

The GDI+ security update for September 2004 addresses newly discovered issues in JPEG processing technology. This issue affects software that supports this image format, including some versions of Microsoft Windows, Microsoft Office, and Microsoft developer tools. If you have any of the listed software installed on your computer, you should install the related update.

Depending on the software you are using, you may need to install multiple updates from multiple locations.

Important Windows XP Service Pack 2 (SP2) is not affected by the GDI+ issue, and installing Windows XP SP2 eliminates the GDI+ issue in affected Microsoft developer tools and imaging software. However, Windows XP SP2 users may have other Microsoft software installed that requires updating. If you use Windows XP SP2 and Microsoft Office, please visit the Office Update Web site to scan your computer for needed updates.

Bulletin Release Information

Microsoft Security Bulletin MS04-028 was re-released on October 12, 2004, to address an issue that prevented some updates originally released on September 14, 2004, from installing on computers running Windows XP SP2. If you use Windows XP SP2 and if you installed the original updates for Visio 2002, Project 2002, or Office XP, you should return to the Office Update Web site to install the revised updates. For more technical details on this installation issue, see Microsoft Knowledge Base Article 833987, "MS04-028: Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution."

Software affected

* Windows XP
* Windows XP Service Pack 1 (SP1)
* Windows Server 2003
* Windows Journal Viewer
* Internet Explorer 6 SP1
* Office XP SP3
Note Office XP SP3 includes Word 2002, Excel 2002, Outlook 2002, PowerPoint 2002, FrontPage 2002, and Publisher 2002.
* Office 2003
Note Office 2003 includes Word 2003, Excel 2003, Outlook 2003, PowerPoint 2003, FrontPage 2003, Publisher 2003, InfoPath 2003, and OneNote 2003.
* Digital Image Pro 7.0
* Digital Image Pro 9
* Digital Image Suite 9
* Greetings 2002
* Picture It! 2002 (all versions)
* Picture It! 7.0 (all versions)
* Picture It! 9 (all versions, including Picture It! Library)
* Producer for PowerPoint (all versions)
* Project 2002 SP1 (all versions)
* Project 2003 (all versions)
* Visio 2002 SP2 (all versions)
* Visio 2003 (all versions)
* Visual Studio .NET 2002
Note Visual Studio .NET 2002 includes Visual Basic .NET Standard 2002, Visual C# .NET Standard 2002, and Visual C++ .NET Standard 2002.
* Visual Studio .NET 2003
Note Visual Studio .NET 2003 includes Visual Basic .NET Standard 2003, Visual C# .NET Standard 2003, Visual C++ .NET Standard 2003, and Visual J# .NET Standard 2003.
* .NET Framework 1.0 SP2
* .NET Framework 1.0 SDK SP2
* .NET Framework 1.1
* Platform SDK Redistributable: GDI+

--This was all obtained from http://www.microsoft.com/security/bu...0409_jpeg.mspx using google and MSKB.

eyeronic · 12-10-2004, 12:50 PM

Thanks for the info. I was kind of hoping for a critical viewpoint about this and whether it is necessary or if microsoft is full of it and just wants to spy on me.

bendsley · 12-10-2004, 02:05 PM

its a valid exploit

12-10-2004, 09:59 AM	#1 (permalink)
eyeronic I run E. Location: New York	Virtual Machine and GDI+ Windows wants me to do these updates, which I assume is a good thing to do. What the heck is the virtual machine. What the heck is GDI+? Should I really install these things? Is there any disadvantage? __________________ I hold with those that favor fire.

12-10-2004, 11:52 AM	#2 (permalink)
bendsley Professional Loafer Location: texas	The GDI+ security update for September 2004 addresses newly discovered issues in JPEG processing technology. This issue affects software that supports this image format, including some versions of Microsoft Windows, Microsoft Office, and Microsoft developer tools. If you have any of the listed software installed on your computer, you should install the related update. Depending on the software you are using, you may need to install multiple updates from multiple locations. Important Windows XP Service Pack 2 (SP2) is not affected by the GDI+ issue, and installing Windows XP SP2 eliminates the GDI+ issue in affected Microsoft developer tools and imaging software. However, Windows XP SP2 users may have other Microsoft software installed that requires updating. If you use Windows XP SP2 and Microsoft Office, please visit the Office Update Web site to scan your computer for needed updates. Bulletin Release Information Microsoft Security Bulletin MS04-028 was re-released on October 12, 2004, to address an issue that prevented some updates originally released on September 14, 2004, from installing on computers running Windows XP SP2. If you use Windows XP SP2 and if you installed the original updates for Visio 2002, Project 2002, or Office XP, you should return to the Office Update Web site to install the revised updates. For more technical details on this installation issue, see Microsoft Knowledge Base Article 833987, "MS04-028: Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution." Software affected * Windows XP * Windows XP Service Pack 1 (SP1) * Windows Server 2003 * Windows Journal Viewer * Internet Explorer 6 SP1 * Office XP SP3 Note Office XP SP3 includes Word 2002, Excel 2002, Outlook 2002, PowerPoint 2002, FrontPage 2002, and Publisher 2002. * Office 2003 Note Office 2003 includes Word 2003, Excel 2003, Outlook 2003, PowerPoint 2003, FrontPage 2003, Publisher 2003, InfoPath 2003, and OneNote 2003. * Digital Image Pro 7.0 * Digital Image Pro 9 * Digital Image Suite 9 * Greetings 2002 * Picture It! 2002 (all versions) * Picture It! 7.0 (all versions) * Picture It! 9 (all versions, including Picture It! Library) * Producer for PowerPoint (all versions) * Project 2002 SP1 (all versions) * Project 2003 (all versions) * Visio 2002 SP2 (all versions) * Visio 2003 (all versions) * Visual Studio .NET 2002 Note Visual Studio .NET 2002 includes Visual Basic .NET Standard 2002, Visual C# .NET Standard 2002, and Visual C++ .NET Standard 2002. * Visual Studio .NET 2003 Note Visual Studio .NET 2003 includes Visual Basic .NET Standard 2003, Visual C# .NET Standard 2003, Visual C++ .NET Standard 2003, and Visual J# .NET Standard 2003. * .NET Framework 1.0 SP2 * .NET Framework 1.0 SDK SP2 * .NET Framework 1.1 * Platform SDK Redistributable: GDI+ --This was all obtained from http://www.microsoft.com/security/bu...0409_jpeg.mspx using google and MSKB. __________________ "You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."

12-10-2004, 12:50 PM	#3 (permalink)
eyeronic I run E. Location: New York	Thanks for the info. I was kind of hoping for a critical viewpoint about this and whether it is necessary or if microsoft is full of it and just wants to spy on me. __________________ I hold with those that favor fire.

12-10-2004, 02:05 PM	#4 (permalink)
bendsley Professional Loafer Location: texas	its a valid exploit __________________ "You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."