iDefense Security Advisory 10.13.09 – Remote exploitation of a heap based buffer overflow vulnerability in Microsoft Corp.’s Windows GDI+ could allow an attacker to execute arbitrary code with the privileges of the current user. This vulnerability occurs when parsing a malformed TIFF file. By supplying incorrect values in a BitsPerSample tag, it is possible to trigger a heap based buffer overflow. iDefense has confirmed the existence of this vulnerability in Windows XP Service Pack 2. Please see the Microsoft bulletin for additional details on affected software.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/82027/10.13.09-3.txt
Source: https://packetstormsecurity.com/files/82027/iDEFENSE-Security-Advisory-2009-10-13.3.html