NetSight
IP …
critical9.3Public exploit code

CVE-2004-0200

Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execu…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.

Affected products

VendorProductAffected versions
Microsoft.Net Framework
Version 1.0
MicrosoftDigital Image Pro
Versions 7.0, 9
MicrosoftDigital Image Suite
Version 9
MicrosoftExcel
Versions 2002, 2003
MicrosoftFrontpage
Versions 2002, 2003
MicrosoftGreetings
Version 2002
MicrosoftInfopath
Version 2003
MicrosoftOffice
Versions 2003, xp
MicrosoftOnenote
Version 2003
MicrosoftOutlook
Versions 2002, 2003
MicrosoftPicture It
Versions 7.0, 9, 2002
MicrosoftPowerpoint
Versions 2002, 2003

References