Microsoft Corp. has released 12 security bulletins encompassing 21 vulnerabilities. This report provides an initial summary of the pending issues.
 

Security Bulletin MS06-021: Cumulative Security Update for Internet Explorer (916281)
http://www.microsoft.com/technet/security/bulletin/MS06-021.mspx

CVE Number: CVE-2005-4089
iDefense Title: Microsoft Internet Explorer CSS Cross-Domain Information Disclosure Vulnerability
iDefense Master ID: 449052
iDefense Severity: LOW

Remote exploitation of an cross-domain information disclosure vulnerability in Microsoft Corp.'s Internet Explorer Web browser could allow attackers to read information from other domains.

CVE Number: CVE-2006-1303
iDefense Title: Microsoft Internet Explorer Wmm2fxa.dll COM Object Instantiation Memory Corruption Vulnerability
iDefense Master ID: 449061
iDefense Severity: HIGH

Remote exploitation of a design error vulnerability in Microsoft Corp.'s Internet Explorer Web browser could allow attackers to execute arbitrary code on affected systems.

CVE Number: CVE-2006-1626
iDefense Title: Microsoft Corp.'s Internet Explorer Address Bar Spoofing Vulnerability
iDefense Master ID: 444873
iDefense Severity: LOW

Remote exploitation of an address bar spoofing vulnerability in Microsoft Corp.'s Internet Explorer Web browser could allow attackers to spoof trusted Web addresses in the address bar while the actual content displayed is a malicious Web page.

CVE Number: CVE-2006-2218
iDefense Title: Microsoft Internet Explorer CStyleSheet::ChangeStatus Memory Corruption Vulnerability
iDefense Master ID: 447479
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code.

CVE Number: CVE-2006-2382
iDefense Title: Microsoft Internet Explorer UTF-8 HTML Decoding Memory Corruption Vulnerability
iDefense Master ID: 449050
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code.

CVE Number: CVE-2006-2383
iDefense Title: Microsoft Internet Explorer DXImageTransform ActiveX control Control Memory Corruption Vulnerability
iDefense Master ID: 449049
iDefense Severity: HIGH

Remote exploitation of an vulnerability in Microsoft Corp.'s DXImageTransform ActiveX control could allow attackers to corrupt memory in a way that allows the arbitrary execution of code when viewing malicious Web pages.

CVE Number: CVE-2006-2384
iDefense Title: Microsoft Internet Explorer Address Bar Modal Dialog Box Spoofing Design Error Vulnerability
iDefense Master ID: 449056
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s Internet Explorer Web browser could allow an attacker to display spoofed content in a browser window.

CVE Number: CVE-2006-2385
iDefense Title: Microsoft Internet Explorer .mht File Memory Corruption Vulnerability
iDefense Master ID: 449054
iDefense Severity: HIGH

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer browser could allow attackers to execute arbitrary code in the context of the browsing user.
 

Security Bulletin MS06-022: Vulnerability in ART Image Rendering Could Allow Remote Code Execution (918439)
http://www.microsoft.com/technet/security/bulletin/MS06-022.mspx

CVE Number: CVE-2006-2378
iDefense Title: Microsoft Internet Explorer ART File Parsing Heap Corruption Vulnerability (iDefense Exclusive)
iDefense Master ID: 438986
iDefense Severity: HIGH
iDefense Initial Disclosure Date: Feb. 6, 2006

Remote exploitation of a heap corruption vulnerability in Microsoft Corp.'s Internet Explorer allows attackers to execute arbitrary code.
 

Security Bulletin MS06-023: Vulnerability in Microsoft JScript Could Allow Remote Code Execution (917344)
http://www.microsoft.com/technet/security/bulletin/MS06-023.mspx

CVE Number: CVE-2006-1313
iDefense Title: Microsoft JScript Early Object Release Code Execution Vulnerability
iDefense Master ID: 449055
iDefense Severity: HIGH

Remote exploitation of a design error vulnerability in multiple versions of Microsoft Corp.'s JScript could allow an attacker to execute arbitrary code.
 

Security Bulletin MS06-024: Vulnerability in Windows Media Player Could Allow Remote Code Execution (917734)
http://www.microsoft.com/technet/security/bulletin/MS06-024.mspx

CVE Number: CVE-2006-0025
iDefense Title: Microsoft Windows Media Player PNG Chunk Decoding Stack-Based Buffer Overflow Vulnerability
iDefense Master ID: 440843
iDefense Severity: HIGH
iDefense Initial Disclosure Date: Feb. 20, 2006

Remote exploitation of a stack-based buffer overflow in the handling of PNG image file chunks by Microsoft Corp.'s Windows Media Player could allow attackers to execute arbitrary code.
 

Security Bulletin MS06-025: Vulnerability in Routing and Remote Access Could Allow Remote Code Execution (911280)
http://www.microsoft.com/technet/security/bulletin/MS06-025.mspx

CVE Number: CVE-2006-2370
iDefense Title: Microsoft Windows Routing and Remote Access Buffer Overflow Vulnerability
iDefense Master ID: 449051
iDefense Severity: HIGH

Remote exploitation of a buffer overflow vulnerability in the Routing and Remote Access Service (RRAS) could allow an attacker to execute arbitrary code and take complete control of a system.

CVE Number: CVE-2006-2371
iDefense Title: Microsoft Routing and Remote Access Buffer Overflow Vulnerability
iDefense Master ID: 449048
iDefense Severity: MEDIUM

Remote exploitation of a buffer overflow vulnerability in Microsoft Corp.'s Routing and Remote Access service could allow an attacker to execute arbitrary machine code with the privileges of the RASMAN process.
 

Security Bulletin MS06-026: Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (918547)
http://www.microsoft.com/technet/security/bulletin/MS06-026.mspx

CVE Number: CVE-2006-2376
iDefense Title: Microsoft Windows Graphics Rendering Engine WMF File Handling Vulnerability
iDefense Master ID: 449053
iDefense Severity: MEDIUM

Remote exploitation of a file handling vulnerability in Microsoft Corp.'s Windows 98, Windows 98 SE and Windows ME could allow an attacker to execute arbitrary code on a vulnerable system.
 

Security Bulletin MS06-027: Vulnerability in Microsoft Word Could Allow Remote Code Execution (917336)
http://www.microsoft.com/technet/security/bulletin/MS06-027.mspx

CVE Number: CVE-2006-2492
iDefense Title: Microsoft Word Malformed OLE Structure Code Execution Vulnerability
iDefense Master ID: 448399
iDefense Severity: MEDIUM

Remote exploitation of an input validation vulnerability within multiple versions of Microsoft Corp.'s Word word processor could allow an attacker to execute arbitrary code on the affected system.
 

Security Bulletin MS06-028: Vulnerability in Microsoft PowerPoint Could Allow Remote Code Execution (916768)
http://www.microsoft.com/technet/security/bulletin/MS06-028.mspx

CVE Number: CVE-2006-0022
iDefense Title: Microsoft PowerPoint Malformed Record Buffer Overflow Vulnerability
iDefense Master ID: 449057
iDefense Severity: MEDIUM

Remote exploitation of a buffer overflow vulnerability within versions 2004 and earlier of Microsoft Corp.'s PowerPoint presentation utility could allow an attacker to execute arbitrary code on the affected host.
 

Security Bulletin MS06-029: Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)
http://www.microsoft.com/technet/security/bulletin/MS06-029.mspx

CVE Number: CVE-2006-1193
iDefense Title: Microsoft Exchange Server With Outlook Web Access Script Injection Vulnerability
iDefense Master ID: 449058
iDefense Severity: MEDIUM

Remote exploitation of a script injection vulnerability within Microsoft Corp.'s Exchange Server when running Outlook Web Access could allow attackers to execute script code with the privileges of the user running the Outlook Web Access client.
 

Security Bulletin MS06-030: Vulnerability in Server Message Block Could Allow Elevation of Privilege (914389)
http://www.microsoft.com/technet/security/bulletin/MS06-030.mspx

CVE Number: CVE-2006-2373
iDefense Title: Microsoft Windows MRXSMB.SYS MRxSmbCscIoctlOpenForCopyChunk Buffer Overflow Vulnerability (iDefense Exclusive)
iDefense Master ID: 433419
iDefense Severity: MEDIUM
iDefense Initial Disclosure Date: Jan. 17, 2006

Local exploitation of a buffer overflow vulnerability in Microsoft Corp.'s Windows Operating System could allow attackers to gain SYSTEM privileges.

CVE Number: CVE-2006-2374
iDefense Title: Microsoft Windows MRXSMB.SYS MrxSmbCscIoctlCloseForCopyChunk DoS Vulnerability (iDefense Exclusive)
iDefense Master ID: 433418
iDefense Severity: MEDIUM
iDefense Initial Disclosure Date: Jan. 17, 2006

Local exploitation of an access validation error in Microsoft Corp.'s Windows Operating System could allow attackers to cause a denial of service (DoS) condition.
 

Security Bulletin MS06-031: Vulnerability in RPC Mutual Authentication Could Allow Spoofing (917736)
http://www.microsoft.com/technet/security/bulletin/MS06-031.mspx

CVE Number: CVE-2006-2380
iDefense Title: Microsoft Windows 2000 SP4 RPC Mutual Authentication Design Error Vulnerability
iDefense Master ID: 449059
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s Windows 2000 Service Pack 4 could allow an attacker to impersonate a valid RPC server.
 

Security Bulletin MS06-032: Vulnerability in TCP/IP Could Allow Remote Code Execution (917953)
http://www.microsoft.com/technet/security/bulletin/MS06-032.mspx

CVE Number: CVE-2006-2379
iDefense Title: Microsoft IP Source Routing Buffer Overflow Vulnerability
iDefense Master ID: 449060
iDefense Severity: MEDIUM

Remote exploitation of a buffer overflow vulnerability in Microsoft Corp.'s IP Source Routing feature could allow an attacker to execute arbitrary code.