Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.76686.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Microsoft Subscribe
.net Framework Subscribe
Digital Image Pro Subscribe
Digital Image Suite Subscribe
Excel Subscribe
Frontpage Subscribe
Greetings Subscribe
Infopath Subscribe
Office Subscribe
Onenote Subscribe
Outlook Subscribe
Picture It Subscribe
Powerpoint Subscribe
Producer Subscribe
Project Subscribe
Publisher Subscribe
Visio Subscribe
Visual Basic Subscribe
Visual C\# Subscribe
Visual C\+\+ Subscribe
Visual J\# .net Subscribe
Visual Studio .net Subscribe
Windows 2003 Server Subscribe
Windows Xp Subscribe
Word Subscribe

Configuration 1 [-]

OR cpe:2.3:a:microsoft:.net_framework:1.0:sp2:sdk:*:*:*:*:*
cpe:2.3:a:microsoft:digital_image_pro:7.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:digital_image_pro:9:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:digital_image_suite:9:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:frontpage:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:frontpage:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:greetings:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:infopath:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:onenote:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:picture_it:7.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:picture_it:9:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:picture_it:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powerpoint:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:powerpoint:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:producer:*:gold:office_powerpoints:*:*:*:*:*
cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:project:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:publisher:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:publisher:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:visio:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_basic:2002:*:.net_standard:*:*:*:*:*
cpe:2.3:a:microsoft:visual_basic:2003:*:.net_standard:*:*:*:*:*
cpe:2.3:a:microsoft:visual_c\#:2002:*:.net_standard:*:*:*:*:*
cpe:2.3:a:microsoft:visual_c\#:2003:*:.net_standard:*:*:*:*:*
cpe:2.3:a:microsoft:visual_c\+\+:2002:*:.net_standard:*:*:*:*:*
cpe:2.3:a:microsoft:visual_c\+\+:2003:*:.net_standard:*:*:*:*:*
cpe:2.3:a:microsoft:visual_j\#_.net:2003:*:.net_standard:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_.net:2002:gold:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_.net:2003:gold:*:*:*:*:*:*
cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:word:2003:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:gold:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://marc.info/?l=bugtraq&m=109524346729948&w=2 cve-icon cve-icon
http://www.kb.cert.org/vuls/id/297462 cve-icon cve-icon
http://www.us-cert.gov/cas/techalerts/TA04-260A.html cve-icon cve-icon
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-028 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/16304 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1105 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1721 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2706 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3038 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3082 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3320 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3810 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3881 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4003 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4216 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4307 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-08T00:10:03.857Z

Reserved: 2004-03-11T00:00:00

Link: CVE-2004-0200

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2004-09-28T04:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2004-0200

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses