TITLE:
Microsoft PowerPoint / Visio Viewer JPEG Processing Buffer Overflow

SECUNIA ADVISORY ID:
SA12671

VERIFY ADVISORY:
http://secunia.com/advisories/12671/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Microsoft Office Visio 2002 Viewer
http://secunia.com/product/4042/
Microsoft Office PowerPoint 2003 Viewer
http://secunia.com/product/4033/
Microsoft Office Visio 2003 Viewer
http://secunia.com/product/4034/

DESCRIPTION:
A vulnerability has been discovered in three Microsoft Office
Viewers, which can be exploited by malicious people to compromise a
user's system.

For more information:
SA12528

The vulnerability has been confirmed in older versions of Visio 2002
Viewer, Visio 2003 Viewer, and PowerPoint 2003 Viewer.

SOLUTION:
Install the latest versions of the viewers, which include an updated
version of the file "gdiplus.dll".

PowerPoint Viewer 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyID=428d5727-43ab-4f24-90b7-a94784af71a4&displaylang=en

Visio Viewer 2002:
http://www.microsoft.com/downloads/details.aspx?FamilyID=8fad9237-c0a7-4b80-a5df-46ce54dad2df&displaylang=en

Visio Viewer 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyID=3fb3bd5c-fed1-46cf-bd53-da23635ab2df&DisplayLang=en

PROVIDED AND/OR DISCOVERED BY:
Discussed on various mailing lists.

OTHER REFERENCES:
SA12528:
http://secunia.com/advisories/12528/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------