MS security bulletin Vulnerabilities in GDI+ Could Allow Remote Code Execution (957488) lists MS products affected including VFP 8.0 and VFP 9.0. It supersedes MS security bulletin MS08-052 - Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593). I blogged about it at GDI+ security updates for VFP 8.0 and VFP 9.0

MS security bulletin MS08-070 - Vulnerabilities in ActiveX Controls Could Allow Remote Code Execution (932349) lists MS products affected including VFP 8.0 and VFP 9.0

MS security bulletin MS08-052 - Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593) lists many MS products affected including VFP 8.0 and VFP 9.0