1 reply to this topic

[Stefan Krueger]

A Developer's View of the GDI+ Security Vulnerability

You've probably already heard about the critical security vulnerability that Microsoft has discovered in their GDI+ library. While most articles about this topic describe which actions you should take as a user of Microsoft products, I've written an article that focuses on the implications this vulnerability has for software developers, particularly in setup programs.

Note: You may be redistributing GDIPLUS.DLL without being aware of it. Many development tools have an option to automatically include required runtime files in your setup. In case of Windows Installer (MSI) tools this is usually accomplished by adding the gdiplus.msm merge module to your setup. Therefore it may not be immediately obvious to you that GDIPLUS.DLL is included in your setup.

Read the article:
http://www.installsi.../go/gdiplus.htm

[Stefan Krueger]

InstallShield has posted the fixed gdiplus.msm in their merge module gallery.