Secunia

Multiple vulnerabilities have been reported in various Microsoft products, which can be exploited by malicious people to compromise a vulnerable system.

1) An error in the GDI+ subsystem when handling gradient sizes can be exploited to cause a heap-based buffer overflow via a specially crafted file.

2) An error in the GDI+ subsystem when parsing EMF files can be exploited to cause memory corruption via a specially crafted EMF image file.

3) An error in the GDI+ subsystem when parsing records in GIF images can be exploited via a GIF image file containing a specially crafted graphic control extension.

4) An error in the GDI+ subsystem when parsing WMF files can be exploited to cause a buffer overflow via a specially crafted WMF image file.

5) An integer overflow in the GDI+ subsystem when parsing BMP file headers can be exploited to cause a buffer overflow via a BMP image file containing a specially crafted BitMapInfoHeader.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) The vendor credits Greg MacManus, iDefense Labs.
2) The vendor credits Bing Liu, Fortinet.
3) The vendor credits Ivan Fratric via ZDI and Peter Winter-Smith, NGSSoftware.
4) The vendor credits Assurent Secure Technologies.
5) The vendor credits an anonymous person via ZDI.

Changelog
Further details available in Customer Area

Original Advisory
MS08-052 (KB954593, KB938464):
http://www.microsoft.com/technet/security/Bulletin/MS08-052.mspx

Microsoft:
http://www.microsoft.com/technet/security/advisory/956391.mspx

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=743

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-08-055/
http://www.zerodayinitiative.com/advisories/ZDI-08-056/

Assurent:
http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064334.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area