Microsoft Corp. has released 11 Security Bulletins encompassing 20 vulnerabilities. This report provides an initial summary of these pending issues.
 

Security Bulletin MS08-056: Vulnerabilities in Microsoft Office Could Allow Information Disclosure (957699)
http://www.microsoft.com/technet/security/bulletin/MS08-056.mspx

CVE Number: CVE-2008-4020
iDefense Title: Microsoft Office Content-Disposition Header Cross-Site Scripting Vulnerability
iDefense Master ID: 473814
iDefense Severity: MINIMAL

Remote exploitation of an input validation vulnerability in Microsoft Corp.'s Office could allow an attacker to steal sensitive information on the targeted host.
 

Security Bulletin MS08-057: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (956416)
http://www.microsoft.com/technet/security/bulletin/MS08-057.mspx

CVE Number: CVE-2008-3471
iDefense Title: Microsoft Excel File Format BIFF Unspecified Vulnerability
iDefense Master ID: 473827
iDefense Severity: MEDIUM

Remote exploitation of an unspecified file format vulnerability in multiple versions of Microsoft Corp.'s Excel could allow attackers to execute arbitrary code on the targeted host.

CVE Number: CVE-2008-3477
iDefense Title: Microsoft Office Visual Basic for Applications Heap Buffer Overflow Vulnerability (iDefense Exclusive)
iDefense Master ID: 470775
iDefense Severity: MEDIUM
iDefense Initial Disclosure Date: July 21, 2008

Remote exploitation of a heap buffer overflow vulnerability in Microsoft Corp.'s Office Visual Basic for Applications (VBA) could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2008-3477
iDefense Title: Microsoft Office Visual Basic for Applications Invalid Array Index Vulnerability (iDefense Exclusive)
iDefense Master ID: 470772
iDefense Severity: MEDIUM
iDefense Initial Disclosure Date: July 21, 2008

Remote exploitation of an invalid array index vulnerability in Microsoft Corp.'s Office Visual Basic for Applications (VBA) could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2008-3477
iDefense Title: Microsoft Office Visual Basic for Applications Heap Buffer Overflow Vulnerability (iDefense Exclusive)
iDefense Master ID: 468805
iDefense Severity: MEDIUM
iDefense Initial Disclosure Date: April 17, 2008

Remote exploitation of a heap overflow vulnerability in Microsoft Corp.'s Office Visual Basic for Applications (VBA) could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2008-3477
iDefense Title: Microsoft Office Visual Basic for Applications Memory Corruption Vulnerability (iDefense Exclusive)
iDefense Master ID: 468308
iDefense Severity: MEDIUM
iDefense Initial Disclosure Date: April 1, 2008

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Office Visual Basic for Applications (VBA) could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2008-3477
iDefense Title: Microsoft Office Visual Basic for Applications Integer Overflow Vulnerability (iDefense Exclusive)
iDefense Master ID: 468806
iDefense Severity: MEDIUM
iDefense Initial Disclosure Date: April 17, 2008

Remote exploitation of an integer overflow vulnerability in Microsoft Corp.'s Office Visual Basic for Applications (VBA) could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2008-4019
iDefense Title: Microsoft Excel Formula Parsing REPT Function Integer Overflow Vulnerability
iDefense Master ID: 473828
iDefense Severity: MEDIUM

Remote exploitation of an integer overflow vulnerability in multiple versions of Microsoft Corp.'s Excel could allow an attacker to execute arbitrary code on the targeted host.
 

Security Bulletin MS08-058: Cumulative Security Update for Internet Explorer (956390)
http://www.microsoft.com/technet/security/bulletin/MS08-058.mspx

CVE Number: CVE-2008-2947
iDefense Title: Microsoft Internet Explorer 7 Frame Cross-Domain Access Validation Error Vulnerability
iDefense Master ID: 470291
iDefense Severity: MEDIUM

Remote exploitation of an access validation error vulnerability in version 7 of Microsoft Corp.'s Internet Explorer could allow attackers to bypass security restrictions and potentially execute arbitrary code.

CVE Number: CVE-2008-3472
iDefense Title: Microsoft Internet Explorer HTML Elements Same Origin Policy Bypass Vulnerability
iDefense Master ID: 473813
iDefense Severity: MEDIUM

Remote exploitation of an input validation vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to view sensitive information or possibly execute arbitrary code, depending on the affected version of Internet Explorer.

CVE Number: CVE-2008-3473
iDefense Title: Microsoft Internet Explorer Cross-Domain Vulnerability in Event Handling
iDefense Master ID: 473819
iDefense Severity: MEDIUM

Remote exploitation of an input validation vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to view sensitive information or possibly execute arbitrary code, depending on the affected version of Internet Explorer.

CVE Number: CVE-2008-3474
iDefense Title: Microsoft Cross-Domain Information Disclosure Vulnerability
iDefense Master ID: 473832
iDefense Severity: MEDIUM

Remote exploitation of an information disclosure vulnerability in Microsoft Corp.'s Internet Explorer could lead to the compromise of sensitive information contained in the user's Web browser.

CVE Number: CVE-2008-3475
iDefense Title: Microsoft Internet Explorer Memory Corruption Vulnerability
iDefense Master ID: 473815
iDefense Severity: HIGH

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code.

CVE Number: CVE-2008-3476
iDefense Title: Microsoft Internet Explorer Memory Corruption Vulnerability
iDefense Master ID: 473816
iDefense Severity: HIGH

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code.
 

Security Bulletin MS08-059: Vulnerability in Host Integration Server RPC Service Could Allow Remote Code Execution (956695)
http://www.microsoft.com/technet/security/bulletin/MS08-059.mspx

CVE Number: CVE-2008-3466
iDefense Title: Microsoft Host Integration Server 2006 Command Execution Vulnerability (iDefense Exclusive)
iDefense Master ID: 469581
iDefense Severity: HIGH
iDefense Initial Disclosure Date: May 27, 2008

Remote exploitation of an arbitrary command execution vulnerability in Microsoft Corp.'s Host Integration Server 2006 could allow an attacker to execute arbitrary code with the privileges of the affected service.
 

Security Bulletin MS08-060: Vulnerability in Active Directory Could Allow RCE (957280)
http://www.microsoft.com/technet/security/bulletin/MS08-060.mspx

CVE Number: CVE-2008-4023
iDefense Title: Microsoft Windows 2000 Active Directory LDAP Packet Processing Arbitrary Code Execution Vulnerability
iDefense Master ID: 473821
iDefense Severity: HIGH

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Active Directory on Windows 2000 could allow an attacker to execute arbitrary code.
 

Security Bulletin MS08-061: Vulnerability in Windows Kernel Could Allow Elevation of Privilege (954211)
http://www.microsoft.com/technet/security/bulletin/MS08-061.mspx

CVE Number: CVE-2008-2250
iDefense Title: Microsoft Windows Kernel New Window Creation Input Validation Vulnerability
iDefense Master ID: 473812
iDefense Severity: MEDIUM

Local exploitation of an input validation vulnerability in Microsoft Corp.'s Windows could allow an attacker to execute arbitrary code with elevated privileges.

CVE Number: CVE-2008-2251
iDefense Title: Microsoft Windows Kernel System Calls Double Free Vulnerability
iDefense Master ID: 473824
iDefense Severity: MEDIUM

Local exploitation of a memory corruption vulnerability in Microsoft Corp.'s Windows could allow an attacker to execute arbitrary code with elevated privileges.

CVE Number: CVE-2008-2252
iDefense Title: Microsoft Windows Kernel Memory Corruption Vulnerability
iDefense Master ID: 473826
iDefense Severity: MEDIUM

Local exploitation of a memory corruption vulnerability in Microsoft Corp.'s Windows could allow an attacker to execute arbitrary code with elevated privileges.
 

Security Bulletin MS08-062: Vulnerability in Windows Internet Printing Service Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/bulletin/MS08-062.mspx

CVE Number: CVE-2008-1446
iDefense Title: Microsoft Windows Internet Printing Protocol (IPP) Integer Overflow Vulnerability
iDefense Master ID: 473822
iDefense Severity: MEDIUM

Remote exploitation of a buffer overflow vulnerability in Microsoft Corp.'s Windows could allow an attacker to execute arbitrary code on the targeted host.
 

Security Bulletin MS08-063: Vulnerability in SMB Could Allow Remote Code Execution (957095)
http://www.microsoft.com/technet/security/bulletin/MS08-063.mspx

CVE Number: CVE-2008-4038
iDefense Title: Microsoft Windows SMB Protocol File Name Buffer Underflow Vulnerability
iDefense Master ID: 473820
iDefense Severity: MEDIUM

Remote exploitation of a buffer underflow vulnerability in Microsoft Corp.'s Windows Server Message Block (SMB) Protocol allows attackers to execute arbitrary code with elevated privileges.
 

Security Bulletin MS08-064: Vulnerability in Virtual Address Descriptor Manipulation Could Allow Elevation of Privilege(956841)
http://www.microsoft.com/technet/security/bulletin/MS08-064.mspx

CVE Number: CVE-2008-4036
iDefense Title: Microsoft Windows Virtual Address Descriptor Manipulation Integer Underflow Vulnerability
iDefense Master ID: 473829
iDefense Severity: MEDIUM

Local exploitation of an integer underflow vulnerability in Microsoft Corp.'s Windows could allow authenticated attackers to execute arbitrary code with elevated privileges.
 

Security Bulletin MS08-065: Vulnerability in Message Queuing Could Allow Remote Code Execution (951071)
http://www.microsoft.com/technet/security/bulletin/MS08-065.mspx

CVE Number: CVE-2008-3479
iDefense Title: Microsoft Windows 2000 Message Queuing Service RPC Packet Parsing Arbitrary Code Execution Vulnerability
iDefense Master ID: 473825
iDefense Severity: HIGH

Remote exploitation of a heap-based buffer overflow vulnerability in Microsoft Corp.'s Message Queuing Service on Windows 2000 Service Pack 4 could allow an attacker to execute arbitrary code.
 

Security Bulletin MS08-066: Vulnerability in the Microsoft Ancillary Function Driver Could Allow Elevation of Privilege(956803)
http://www.microsoft.com/technet/security/bulletin/MS08-066.mspx

CVE Number: CVE-2008-3464
iDefense Title: Microsoft Windows Ancillary Function Driver Input Validation Vulnerability
iDefense Master ID: 473831
iDefense Severity: MEDIUM

Local exploitation of an input validation vulnerability in Microsoft Corp.'s Windows could allow authenticated attackers to execute arbitrary code with elevated privileges.