Macromedia Products Not Affected by Microsoft JPEG/GDIPlus Vulnerability

Summary

On September 14, 2004, Microsoft released a security bulletin warning that there may be wide-ranging effects on software that handles JPEG images. Macromedia has reviewed its products and found none of them to be at risk from this issue.

Details

For more technical details, please visit Microsoft's security bulletin: http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx.

For users of Macromedia products, the relevant portion of the bulletin states: “not every program that installs this file is vulnerable to this issue because it may not use the Gdiplus.dll file to process JPEG images. However, only the manufacturer of that program can make that determination.”

Although some Macromedia products do install a vulnerable version of gdiplus.dll, no Macromedia product uses this Microsoft graphics library to process JPEG images, therefore there is no security risk.

In some configurations, the following Macromedia products may install a gdiplus.dll file; however, because these products do not invoke the affected JPEG routines, there is no security risk:

• Contribute
• Dreamweaver
• Fireworks
• Flash
• FlashPaper
• FreeHand
• RoboSource Control
• Studio MX

Revisions

September 21, 2004 - Bulletin first created.

Reporting Security Issues

Macromedia is committed to addressing security issues and providing customers with the information on how they can protect themselves. If you identify what you believe may be a security issue with a Macromedia product, please send an email to secure@macromedia.com. We will work to appropriately address and communicate the issue.

Receiving Security Bulletins

When Macromedia becomes aware of a security issue that we believe significantly affects our products or customers, we will notify customers when appropriate. Typically this notification will be in the form of a security bulletin explaining the issue and the response. Macromedia customers who would like to receive notification of new security bulletins when they are released can sign up for our security notification service.

For additional information on security issues at Macromedia, please visit: http://www.macromedia.com/security.

Macromedia products available on the Adobe Store

The following products are available for purchase directly from the Adobe Store:

Macromedia Authorware

Macromedia Captivate

Macromedia Contribute

Macromedia Director MX 2004

Macromedia Dreamweaver 8

Macromedia Fireworks 8

Macromedia Flash Basic 8

Macromedia Flash Professional 8

Macromedia FlashPaper

Standalone Macromedia Flash Player 6 for Pocket PC

Macromedia FreeHand MX

Macromedia HomeSite

Macromedia RoboHelp Office

Macromedia RoboInfo

Macromedia Studio 8

Products not listed here are only available from the Macromedia Store at www.macromedia.com/store .

Place an order on the Adobe Store

To purchase Adobe and Macromedia products in a single online order, do the following:

1. Go to the Adobe Store at http://store.adobe.com/store/ .

2. Choose your region from the pop-up menu at the top of the page.

3. Click All Products on the left side of the page.

4. Click the Macromedia product you want to purchase.

5. Select the appropriate product configuration (retail, upgrade, delivery type, and language) and add it to your cart.

6. Repeat steps 3 through 5 to add additional products.

7. Click Checkout and follow the on-screen instructions to complete your order.

All Macromedia MX version products have been thoroughly tested on the Windows XP platform. The Microsoft Windows XP operating system supports the following Macromedia software:

Windows XP- supported applications

• Authorware 6
• ColdFusion 5 Professional and later (XP Professional only)
• ColdFusion Studio 4.5 and later
• Director Shockwave Studio 8.5.1
• Dreamweaver 4 and later
• Fireworks 4 and later
• Macromedia Flash 5 and later
• FreeHand 10
• HomeSite 4.5 and later
• JRun Server 3.1 and later
• JRun Studio 3
• Dreamweaver UltraDev 4