此安全更新解决 Microsoft Expression Design 中一个秘密报告的漏洞。如果用户打开与特制动态链接库 (DLL) 文件位于同一网络目录下的合法文件（例如 .xpr 或 .DESIGN 文件），此漏洞可能允许远程执行代码。然后，当打开该合法文件时，Microsoft Expression Design 可能尝试加载 DLL 文件并执行其包含的任何代码。要成功进行攻击，用户必须访问不受信任的远程文件系统位置或 WebDAV 共享，并从该位置打开合法文件（例如 xpr 或 .DESIGN 文件），然后由容易受攻击的应用程序加载此文档。
对于 Microsoft Expression Design 的所有受支持版本，此安全更新的等级为“重要”。此安全更新通过更正 Microsoft Expression Design 加载外部库的方式来解决此漏洞。
More
Microsoft Expression Design is a professional illustration and graphic design tool that lets you build compelling assets for both Web and desktop application user interfaces.
Expression Design Service Pack 1 (SP1) is an update to Expression Design. If you are currently using the trial version of Expression Design, simply download and install this service pack and continue to use the trial. If you have purchased Expression Design, download and install this service pack to update your copy of Expression Design.
You can get specific information about the SP1 update in the Microsoft Knowledge Base article (942686), Description of Expression Design Service Pack 1, or the Microsoft Knowledge Base article (942685), Issues that are fixed in Expression Design by Expression Design Service Pack 1.
An updated User Guide is also available for Expression Design SP1. To install the updated User Guide, see Expression Design Service Pack 1 User Guide and follow the instructions.
Help us improve Expression Design by reporting any technical issues. For more insight into Expression Design, please see the Expression team blog.
More