Microsoft Corp. has released eight security bulletins encompassing 10 vulnerabilities. Please note that Microsoft combined two similar iDefense Exclusive reports into one fix. Also note that iDefense has created a separate Threat report to include third-party ActiveX kill bits. This report provides an initial summary of these pending issues.
 

Security Bulletin MS08-018: Vulnerability in Microsoft Project Could Allow Remote Code Execution (950183)
http://www.microsoft.com/technet/security/bulletin/MS08-018.mspx

CVE Number: CVE-2008-1088
iDefense Title: Microsoft Project 2003 Memory Corruption Vulnerability
iDefense Master ID: 468549
iDefense Severity: MEDIUM

Local exploitation of a memory corruption vulnerability in multiple versions of Microsoft Corp.'s Project could allow attackers to execute arbitrary code on the targeted host.
 

Security Bulletin MS08-019: Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (949032)
http://www.microsoft.com/technet/security/bulletin/MS08-019.mspx

CVE Number: CVE-2008-1089
iDefense Title: Microsoft Visio Object Header Validation Memory Corruption Vulnerability
iDefense Master ID: 468548
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in multiple versions of Microsoft Corp.'s Visio could allow an attacker to execute arbitrary code.

CVE Number: CVE-2008-1090
iDefense Title: Microsoft Visio DXF File Format Heap Buffer Overflow Vulnerability
iDefense Master ID: 468551
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in multiple versions of Microsoft Corp.'s Visio could allow an attacker to execute arbitrary code.
 

Security Bulletin MS08-020: Vulnerability in DNS Client Could Allow Spoofing (945553)
http://www.microsoft.com/technet/security/bulletin/MS08-020.mspx

CVE Number: CVE-2008-0087
iDefense Title: Microsoft Windows DNS Client Weak Entropy Transaction ID Packet Spoofing Vulnerability
iDefense Master ID: 468545
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s Windows DNS Client could allow attackers to gain information about DNS transaction IDs, which could result in spoofing attacks.
 

Security Bulletin MS08-021: Vulnerability in GDI Could Allow Remote Code Execution (948590)
http://www.microsoft.com/technet/security/bulletin/MS08-021.mspx

CVE Number: CVE-2008-1083
iDefense Title: Microsoft Windows Graphics Rendering Engine Integer Overflow Vulnerability
iDefense Master ID: 466413
iDefense Severity: HIGH
iDefense Initial Disclosure Date: Dec. 17, 2007

Remote exploitation of an integer overflow vulnerability in multiple versions of Microsoft Corp.'s Windows operating system could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2008-1083
iDefense Title: Microsoft Windows Graphics Rendering Engine Heap Buffer Overflow Vulnerability
iDefense Master ID: 466485
iDefense Severity: HIGH
iDefense Initial Disclosure Date: Dec. 17, 2007

Remote exploitation of a heap-based buffer overflow vulnerability in multiple versions of Microsoft Corp.'s Windows operating system could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2008-1087
iDefense Title: Microsoft Windows Graphics Rendering Engine Stack Buffer Overflow Vulnerability
iDefense Master ID: 468546
iDefense Severity: HIGH
iDefense Initial Disclosure Date: Dec. 17, 2007

Remote exploitation of a stack-based buffer overflow vulnerability in multiple versions of Microsoft Corp.'s Windows operating system could allow an attacker to execute arbitrary code with the privileges of the current user.
 

Security Bulletin MS08-022: Vulnerability in VBScript and JScript Scripting Engines Could Allow Remote Code Execution (944338)
http://www.microsoft.com/technet/security/bulletin/MS08-022.mspx

CVE Number: CVE-2008-0083
iDefense Title: Microsoft Script Engine JScript.dll and VBScript.dll Remote Code Execution Vulnerability
iDefense Master ID: 468547
iDefense Severity: HIGH

Remote exploitation of a buffer overflow vulnerability in versions prior to 5.6.0.8835 in Microsoft Corp.'s VBScript and JScript scripting engines, as included in multiple versions of the Windows operating systems, could allow attackers to execute arbitrary script code in the context of the affected user.
 

Security Bulletin MS08-023: Security Update of ActiveX Kill Bits (948881)
http://www.microsoft.com/technet/security/bulletin/MS08-023.mspx

CVE Number:
iDefense Title: Multiple Vendor ActiveX Control Kill Bit from MS08-023
iDefense Master ID: 468553 (Threat)
iDefense Severity: MEDIUM

This report includes the class identifiers for which customers should set the kill bit for ActiveX controls produced by Microsoft Corp. and third-party vendors.

CVE Number: CVE-2008-1086
iDefense Title: Microsoft HxTocCtrl ActiveX Control Invalid Param Heap Corruption Vulnerability
iDefense Master ID: 452759
iDefense Severity: MEDIUM

Remote exploitation of a heap corruption vulnerability in the Microsoft Help 2.5 ActiveX control allows remote attackers to execute code with the privileges of the currently logged-on user.
 

Security Bulletin MS08-024: Cumulative Security Update for Internet Explorer (947864)
http://www.microsoft.com/technet/security/bulletin/MS08-024.mspx

CVE Number: CVE-2008-1085
iDefense Title: Microsoft Internet Explorer Data Stream Handling Memory Corruption Vulnerability
iDefense Master ID: 468552
iDefense Severity: HIGH

Remote exploitation of an input validation vulnerability in multiple versions of Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code.
 

Security Bulletin MS08-025: Vulnerability in Windows Kernel Could Allow Elevation of Privilege (941693)
http://www.microsoft.com/technet/security/bulletin/MS08-025.mspx

CVE Number: CVE-2008-1084
iDefense Title: Microsoft Windows Kernel User-Mode CallBack Privilege Escalation Vulnerability
iDefense Master ID: 468550
iDefense Severity: MEDIUM

Remote exploitation of an input validation error vulnerability in multiple versions of Microsoft Corp.'s Windows operating system could allow attackers to gain escalated privileges on the targeted host.