Microsoft

(MS06-022) Vulnerability in ART Image Rendering Could Allow Remote Code Execution (918439)

The JG ART DLL is exploited because it does not validate the length of the message before passing it to the allocated buffer. A specially-crafted ART file can cause a heap overflow when the file is rendered via Internet Explorer within the IMG tags. This vulnerability is exploited to execute arbitrary codes.

Vulnerability in Microsoft Word 2002 and 2003 Could Allow Remote Code Execution (919637)

This security advisory refers to a vulnerability in Microsoft Word 2002 and Microsoft Word 2003 that allows remote code execution when a user opens a specially crafted Microsoft Word document.

(MS06-019) Vulnerability in Microsoft Exchange Could Allow Remote Code Execution

This security advisory resolves the newly-discovered vulnerability in the Microsoft Exchange Calendar. This happens because EXCDO and CDOEX functionalities provided with Exchange Server do not properly process certain iCAL and vCAL properties that are provided in email messages.

(MS06-020) Vulnerabilities in Macromedia Flash Player from Adobe Could Allow Remote Code Execution

This security advisory refers to the Macromedia Flash Player vulnerability. Microsoft provides an updated Flash Player (6.0.84.0) in order to resolve this vulnerability, since some Windows versions ship with the Macromedia Flash player.

Microsoft Security Bulletin MS06-016 Cumulative Security Update for Outlook Express (911567)

A remote code execution vulnerability exists in Outlook Express when using a Windows Address Book (.wab) file that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.

Microsoft Security Bulletin MS06-015 Vulnerability in Windows Explorer Could Allow Remote Code Execution (908531)

A remote code execution vulnerability exists in Windows Explorer because of the way that it handles COM objects. An attacker would need to convince a user to visit a Web site that could force a connection to a remote file server. This remote file server could then cause Windows Explorer to fail in a way that could allow code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft Security Bulletin MS06-014 Vulnerability in the Microsoft Data Access Components (MDAC) Function Could Allow Code Execution (911562)

A remote code execution vulnerability exists in the RDS.Dataspace ActiveX control that is provided as part of the ActiveX Data Objects (ADO) and that is distributed in MDAC. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

MS06-013: Cumulative security update for Internet Explorer

This bulletin replaces several prior security updates. See the frequently asked questions (FAQ) section of this bulletin for the complete list.

(MS06-018) Vulnerability in Microsoft Distributed Transaction Coordinator Could Allow Denial of Service (913580)

This vulnerability allows a malicious user to utilize a specially crafted network message, which it brings to an affected system. If the said routine is successful, the message can cause the affected system to stop responding. An unchecked buffer in the MSDTC service is causing this vulnerability.

(MS06-017) Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting (917627)

The said exploit causes a cross-site scripting (XSS) vulnerability, which could enable an attacker to inject code into a user's session with a Web site.

(MS06-016) Cumulative Security Update for Outlook Express (911567)

An unchecked buffer in WAB functioning within Outlook Express can cause remote code execution.

(MS06-012) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (905413)

This update consists of 6 vulnerabilities in Microsoft Office: five of which concerns Microsoft Excel and one on a "routing slip" in Office.

(MS06-011) Permissive Windows Services DACLs Could Allow Elevation of Privilege (914798)

An escalation of privilege vulnerability exists on Windows XP Service Pack 1 on the identified Windows services where the permissions are set by default to a level that allows a low-privileged user to change properties associated with the service.

MS06-010 Vulnerability in PowerPoint 2000 Could Allow Information Disclosure (889167)

MS06-008 Vulnerability in Web Client Service Could Allow Remote Code Execution (911927)