CVE-2008-3012

published 2008-09-11

CVE-2008-3012: gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3…

Priority P2 58 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 does not properly perform memory allocation, which allows remote attackers to execute arbitrary code via a malformed EMF image file, aka "GDI+ EMF Memory Corruption Vulnerability."

Affected

16 ranges

Vendor	Product	Version range	Fixed in
microsoft	digital_image_suite	—	—
microsoft	forefront_client_security	—	—
microsoft	internet_explorer	—	—
microsoft	office	—	—
microsoft	office	—	—
microsoft	office_powerpoint_viewer	—	—
microsoft	report_viewer	—	—
microsoft	report_viewer	—	—
microsoft	server	—	—
microsoft	sql_server	—	—
microsoft	sql_server_reporting_services	—	—
microsoft	visio	—	—
microsoft	windows	—	—
microsoft	windows-nt	—	—
microsoft	windows-nt	—	—
microsoft	works	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119