Inside MS Patch Tuesday: Pay Attention to MS09-072

Guest editorial by Jason Miller Microsoft has released six new security bulletins for December. They have also released two new security advisories as well as one bulletin that has been re-released. In addition to the Microsoft releases, even though Adobe’s quarterly security update is scheduled...

Microsoft Office Project Memory Validation Remote Code Execution (MS09-074; CVE-2009-0102)

Microsoft Project is a project management software program designed to assist project managers to stay informed, keep project teams aligned, increase productivity and control project work, schedules, and finances. A remote code execution vulnerability has been identified in the way Microsoft...

Microsoft Project Invalid Resource Memory Allocation Remote Code Execution Vulnerability

Description Microsoft Project is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected Microsoft...

MS09-074: Vulnerability in Microsoft Office Project Could Allow Remote Code Execution (967183)

The remote host contains a version of Microsoft Project that has a vulnerability in the way it validates memory that could be used by an attacker to execute arbitrary code on the remote host. To exploit this vulnerability, an attacker would need to spend a specially crafted Project document to a...

Microsoft GDI+ TIFF File Processing 'BitsPerSample' Tag Remote Code Execution Vulnerability

Description Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly processes TIFF image files. An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts...

Microsoft Windows Common AVI ActiveX Control File Parsing Buffer Overflow Vulnerability(MS08-070)

CVE-2008-4255 Microsoft Windows Common AVI ActiveX control is prone to a remote buffer-overflow vulnerability. Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control typically Internet Explorer. Successful exploits will...

Microsoft Windows Common AVI ActiveX Control File Parsing Buffer Overflow Vulnerability

Description Microsoft Windows Common AVI ActiveX control is prone to a remote buffer-overflow vulnerability. Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control typically Internet Explorer. Successful exploits will compromi...

Microsoft FlexGrid ActiveX Control Memory Corruption Vulnerability

Description Microsoft FlexGrid ActiveX control is prone to a remote memory-corruption vulnerability. Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control typically Internet Explorer. Successful exploits will compromise the...

MS08-018: Vulnerability in Microsoft Project Could Allow Remote Code Execution (950183)

The remote host contains a version of Microsoft Project that has a vulnerability in the way it validates memory that could be used by an attacker to execute arbitrary code on the remote host. To exploit this vulnerability, an attacker would need to spend a specially crafted Project document to a...

Microsoft Project资源内存分配远程代码执行漏洞（MS08-018）

BUGTRAQ ID: 28607 CVECAN ID: CVE-2008-1088 Project是微软Office套件中的项目管理和控制组件。 Microsoft Project在打开Project文件时没有正确地验证内存资源分配。如果用户受骗打开了畸形文档，就可能触发这个漏洞，导致执行任意指令。 Microsoft Project 2003 SP2 Microsoft Project 2002 SP1 Microsoft Project 2000 Service Release 1 临时解决方法： 不要打开不可信任来源或可信任来源意外接收到的Microsoft Office文件。...

CVE-2008-1088

Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory resource allocations."...

Input validation

Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory resource allocations."...

CVE-2008-1088

CVE-2008-1088 corresponds to a memory validation vulnerability in Microsoft Project that could allow remote code execution when opening specially crafted Project files. Affected products include Microsoft Project 2000 Service Release 1, 2002 Service Pack 1, and 2003 Service Pack 2. The underlying...

CVE-2008-1088

Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory resource allocations."...

Security Update for Microsoft Project 2002 (KB949005)

A security vulnerability exists in Microsoft Project 2002 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Microsoft Project Invalid Memory Pointer Code Execution (MS08-018; CVE-2008-1088)

Microsoft Project is a project management software program designed to assist project managers to stay informed, keep project teams aligned, increase productivity and control project work, schedules, and finances.A remote code execution vulnerability has been identified in the way Microsoft Proje...

Microsoft Project Resource Memory Allocation Remote Code Execution Vulnerability

Description Microsoft Project is prone to a remote code-execution vulnerability. An attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected Microsoft...

Microsoft Office不安全文档签名漏洞

Microsoft Office 2007是一款微软开发的流行的办公处理应用程序。 Microsoft Office 2007不安全对基于XML文档的签名，远程攻击者可以利用漏洞伪造签名，使目标用户盲目信任文档。 Microsoft Office文档根据文件中docProps/core.xml的DublinCore metadata来携带META数据信息，在这些META数据信息中"LastModifiedBy", "creator"字段可通过"Office Button - Prepare -...

Microsoft Office Web Component Memory Access Violation Denial of Service Vulnera

Microsoft Office Web组件一款基与Web的数据透视表控件。 Microsoft Office Web包含的ActiveX控件存在设计错误，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 构建恶意的EWB页，诱使用户访问，可导致对应用程序进行拒绝服务攻击。 Microsoft Office Web Components 2003 0 + Microsoft BizTalk Server 2002 Developer Edition + Microsoft BizTalk Server 2002 Enterprise Edition + Microsoft Commer...

Microsoft Security Bulletin MS07-013 Vulnerability in Microsoft RichEdit Could Allow Remote Code Execution (918118)

Microsoft Security Bulletin MS07-013 Vulnerability in Microsoft RichEdit Could Allow Remote Code Execution 918118 Published: February 13, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Windows and/or Microsoft Office Impact of Vulnerability: Remote Code...