Microsoft Patches Bevy of GDI Flaws

As promised, Microsoft Corp. today released an out-of-band update to correct a bevy of flaws in its Windows GDI implementation.

At least one of these flaws, which collectively affect all supported versions of Windows -- including Windows Vista -- has already been linked to a known zero day attack exploit. Microsoft last week confirmed that an attacker who successfully exploits a flaw in its Windows Animated Cursor Handling implementation can take complete control of a compromised Windows system.

Today's update patches this flaw and six others.

The complete tally includes:

The Windows Animated Cursor Handling vulnerability is the only known flaw for which exploit code -- and actual zero day attacks -- have been substantiated. Microsoft originally planned to patch these flaws during its scheduled April 10 update (part of its monthly Patch Tuesday update proces), but instead decided to release an out-of-band update, officials confirm.

"We have been monitoring the situation throughout and our indications, and those of our MSRA partners, show there is a threat for attacks against this vulnerability to increase, although we haven't seen anything widespread," wrote Christopher Budd on Microsoft's Security Response Center (MSRC) blog. "Based on customer feedback and our teams' ability to complete testing in an expedited manner by working around the clock, we've gone ahead and released this update early to help better protect customers from this threat."

Customers typically like to take their time before rolling out operating system updates on production systems but, in this case, Budd urges admins to expedite this process. "We are encouraging customers to test and deploy this update as quickly as possible as well as ensure that you have the latest signatures and updates for your security products such as anti-virus," he indicated.

Budd recommends that users also check Microsoft's Master Knowledge Base article to determine which potential conflicts-- if any -- could crop up once they deploy the update. He noted that there's at least one known issue which affects Windows XP SP2 users of Realtek's HD Audio Control Panel, for which there is a hotfix available.

About the Author

Stephen Swoyer is a Nashville, TN-based freelance journalist who writes about technology.


  • Microsoft Previews Microsoft Teams for Linux

    Microsoft on Tuesday announced a "limited preview" release of Microsoft Teams for certain Linux desktop operating systems.

  • Hyper-V Architecture: Some Clarifications

    Brien answers two thought-provoking reader questions. First, do Hyper-V VMs have direct hardware access? And second, how is it possible to monitor VM resource consumption from the host operating system?

  • Old Stone Wall Graphic

    Microsoft Addressing 36 Vulnerabilities in December Security Patch Release

    Microsoft on Tuesday delivered its December bundle of security patches, which affect Windows, Internet Explorer, Office, Skype for Business, SQL Server and Visual Studio.

  • Microsoft Nudging Out Classic SharePoint Blogs

    So-called "classic" blogs used by SharePoint Online subscribers are on their way toward "retirement," according to Dec. 4 Microsoft Message Center post.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.