Windows GDI+ update prevents Web-image attacks

By Susan Bradley All versions of Windows XP and Vista have been found to be susceptible to infected image files in software and on Web sites, Microsoft announced on Patch Tuesday. The fix Microsoft released this week for XP and Vista is also needed by the .NET Framework, MS Office versions from XP to 2007, Works 8.5, and Forefront Client Security.

This week’s 13 separate security updates address 34 different vulnerabilities. Many of the security flaws affect all versions of Windows XP and Vista — and, in a couple of instances, Windows 7 as well. Topping the list of critical patches is MS09-062 (957488), which plugs a hole in Windows’ GDI+ graphics-rendering engine.

Without the patch, your system could become infected simply by opening an infected image in a software program or on a Web site. Microsoft Knowledge Base article 957488 lists the many products affected by this vulnerability:

• The update for Windows XP, Vista, and Server 2003 and 2008 is described in KB article 958869.

• .NET is covered in KB 971108, 971110, and 971111.
  
  

  This article is part of our paid content. Subscribe.

  Already a paid subscriber? Click here to login.

  Related posts:

  1. New Web-based attacks target Windows Media holes
  2. Stealth Windows update prevents XP repair
  3. One quick trick prevents AutoRun attacks
  4. Expect attacks via latest Windows security hole
  5. Heavy patch week to block Web-based attacks