europa-list
[Top] [All Lists]

Europa-List: Jpeg Images

Subject: Europa-List: Jpeg Images
From: Lance Sandford <sandford@melbpc.org.au>
Date: Fri, 24 Sep 2004 14:49:00

Not strictly Europa but we do send and receive a lot of images.

Just a heads up for a new vulnerability, a pretty big one:

http://asia.cnet.com/news/security/0,39037064,39193726,00.htm

"Microsoft published on Tuesday a patch for a major security flaw in its
software's handling of the JPEG graphics format and urged customers to use a
new tool to locate the many applications that are vulnerable.

The critical flaw has to do with how Microsoft's operating systems and other
software process the widely used JPEG image format and could let attackers
create an image file that would run a malicious program on a victim's
computer as soon as the file is viewed. Because the software giant's
Internet Explorer browser is vulnerable, Windows users could fall prey to an
attack just by visiting a Web site that has affected images."


>From http://www.microsoft.com/security/bulletins/200409_jpeg.mspx

Software affected:

    * Windows XP
    * Windows XP Service Pack 1 (SP1)
    * Windows Server 2003
    * Internet Explorer 6 SP1
    * Office XP SP3 (includes Word 2002, Excel 2002, Outlook 2002,
PowerPoint 2002, FrontPage 2002, and Publisher 2002)
    * Office 2003 (includes Word 2003, Excel 2003, Outlook 2003, PowerPoint
2003, FrontPage 2003, Publisher 2003, InfoPath 2003, and OneNote 2003)
    * Digital Image Pro 7.0
    * Digital Image Pro 9
    * Digital Image Suite 9
    * Greetings 2002
    * Picture It! 2002 (all versions)
    * Picture It! 7.0 (all versions)
    * Picture It! 9 (all versions, including Picture It! Library)
    * Producer for PowerPoint (all versions)
    * Project 2002 SP1 (all versions)
    * Project 2003 (all versions)
    * Visio 2002 SP2 (all versions)
    * Visio 2003 (all versions)
    * Visual Studio .NET 2002
      Note  Visual Studio .NET 2002 includes Visual Basic .NET Standard
2002, Visual C# .NET Standard 2002, and Visual C++ .NET Standard 2002.
    * Visual Studio .NET 2003
      Note  Visual Studio .NET 2003 includes Visual Basic .NET Standard
2003, Visual C# .NET Standard 2003, Visual C++ .NET Standard 2003, and
Visual J# .NET Standard 2003.
    * .NET Framework 1.0 SP2
    * .NET Framework 1.0 SDK SP2
    * .NET Framework 1.1
    * Platform SDK Redistributable: GDI+

Patch up, folks.

Regards
Lance Sandford




<Prev in Thread] Current Thread [Next in Thread>
  • Europa-List: Jpeg Images, Lance Sandford <=