Microsoft yesterday warned of security flaws with DirectX's DirectShow component that might be used by an attacker to run hostile code on vulnerable Windows machines.

Redmond has issued a patch - designated as critical - which users are urged to review.

The list of affected software is extensive: Microsoft DirectX 5.2 on Windows 98; MS DirectX 6.1 on Windows 98 SE; DirectX 7.0a and DirectX 9.0a on Windows Me; DirectX and DirectX 9.0a 7.0 on Win 2000; DirectX 8.1 and DirectX 9.0a on Win XP; DirectX 8.1 and DirectX 9.0a on Win Server 2003 are all potentially vulnerable.

rest of story