Nanika

A use-after-free issue allows remote attackers to execute arbitrary code via a crafted web site. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. This issue is related to the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted.

PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length, which allows user-assisted attackers to cause a denial of service (NULL dereference and application crash) via a crafted PowerPoint (.PPT) file, as demonstrated by Nanika.ppt, and a different vulnerability than CVE-2006-3435, CVE-2006-3876, CVE-2006-3877, and CVE-2006-4694. NOTE: the impact of this issue was originally claimed to be arbitrary code execution, but later analysis demonstrated that this was erroneous.

The issue allows user-assisted attackers to cause a denial of service, potentially leading to repeated crashes, and may also enable the execution of arbitrary code. This is achieved through a .url file containing an InternetShortcut tag with a long URL and a large number of "file:" specifiers.