Chaouki Bekrar

The issue is related to an integer overflow in gdiplus.dll, which is part of GDI+ in Microsoft Windows and Office. This allows remote attackers to execute arbitrary code via a crafted EMF image. The vulnerability could be exploited if a user opens a specially crafted EMF image file, potentially allowing an attacker to take complete control of an affected system. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system might be less impacted than those operating with administrative user rights.

A remote code execution issue exists in the way Microsoft Publisher parses Publisher files, allowing attackers to execute arbitrary code via a crafted Publisher file that uses an old file format. An attacker could exploit this by creating a specially crafted Publisher file, which could be included as an e-mail attachment or hosted on a specially crafted or compromised Web site, and then convincing the user to open the file. If a user were logged on with administrative user rights, an attacker who successfully exploited this could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue arises from the improper handling of an unspecified size field in certain older file formats by the pubconv.dll in Microsoft Publisher. This can lead to heap memory corruption, allowing remote attackers to execute arbitrary code or cause a denial of service. A remote code execution vulnerability exists in the way Microsoft Publisher parses Publisher files, which could be exploited by an attacker creating a specially crafted Publisher file. If successfully exploited, an attacker could take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights, especially if the user has administrative rights.

The issue allows remote attackers to execute arbitrary code via a crafted Publisher file that uses an old file format. A remote code execution vulnerability exists in the way that Microsoft Publisher opens Publisher files. An attacker could exploit the vulnerability by creating a specially crafted Publisher file that could be included as an e-mail attachment, or hosted on a specially crafted or compromised Web site, and then convincing the user to open the specially crafted Publisher file. If a user were logged on with administrative user rights, an attacker who successfully exploited this issue could take complete control of an affected system.

A remote code execution issue exists in the way Microsoft Word handles index values inside a specially crafted Word file. This could allow an attacker to take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system may be less impacted than those operating with administrative user rights.

A remote code execution issue exists in the way Microsoft Word handles bookmarks when parsing a specially crafted Word file. This could allow an attacker to execute arbitrary code, potentially taking complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

A double free vulnerability in Microsoft Word allows remote attackers to execute arbitrary code via a Word document with crafted List Format Override (LFO) records. This issue exists in the way that Microsoft Word handles pointers when parsing a specially crafted Word file, which could allow an attacker to take complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.

A remote code execution issue exists in the way Microsoft Word handles malformed records inside a specially crafted Word file. This could allow an attacker to execute arbitrary code and take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited user rights compared to those operating with administrative rights.

A remote code execution issue exists in the way Microsoft Word handles indexes when parsing a specially crafted Word file, allowing attackers to execute arbitrary code via a crafted Word document that triggers memory corruption. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

The issue allows remote attackers to execute arbitrary code via a crafted Word document, triggering memory corruption. A remote code execution vulnerability exists in the way that Microsoft Word parses a specially crafted Word file. An attacker who successfully exploited this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.

A remote code execution issue exists due to improper validation of record information in Microsoft Excel, allowing attackers to execute arbitrary code via a crafted Excel document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

A remote code execution issue exists due to improper validation of record information in Microsoft Excel, allowing attackers to execute arbitrary code via a crafted Excel document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

A remote code execution issue exists due to improper validation of binary file-format information in Microsoft Excel, allowing attackers to execute arbitrary code via a crafted Excel document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

A remote code execution issue exists due to improper validation of record information in Microsoft Excel, allowing attackers to execute arbitrary code via a crafted Excel document. This could enable an attacker to take complete control of an affected system, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

A remote code execution issue exists in the way Microsoft Excel handles specially crafted Excel files. This allows remote attackers to execute arbitrary code via a crafted Excel document. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights.

A remote code execution issue exists due to improper validation of record information in Microsoft Excel, allowing attackers to execute arbitrary code via a crafted Excel document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

A remote code execution issue exists in the way Microsoft Word handles return values when parsing a specially crafted Word file. This could allow an attacker to execute arbitrary code via a crafted document that triggers memory corruption. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.

A remote code execution issue exists due to improper handling of an uninitialized pointer during the parsing of a Word document. This allows attackers to execute arbitrary code via a crafted document, triggering memory corruption. An attacker who successfully exploits this issue could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited user rights compared to those operating with administrative rights.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in an application crash, via vectors involving element focus. This is due to a use-after-free vulnerability in WebKit.