Microsoft Corp. has released eight Security Bulletins encompassing 23 vulnerabilities. This report provides an initial summary of these pending issues.
 

Security Bulletin MS09-009: Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557)
http://www.microsoft.com/technet/security/bulletin/MS09-009.mspx

CVE Number: CVE-2009-0100
iDefense Title: Microsoft Excel Unspecified Malformed Objects Memory Corruption Vulnerability
iDefense Master ID: 485203
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Excel could allow attackers to execute arbitrary code on the targeted host.

CVE Number: CVE-2009-0238
iDefense Title: Microsoft Excel Invalid Object Access Arbitrary Code Execution Vulnerability
iDefense Master ID: 483658
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Excel could allow an attacker to execute arbitrary code with the privileges of the targeted user.
 

Security Bulletin MS09-010: Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477)
http://www.microsoft.com/technet/security/bulletin/MS09-010.mspx

CVE Number: CVE-2008-4841
iDefense Title: Microsoft WordPad Word97 Text Converter Stack Buffer Overflow Vulnerability
iDefense Master ID: 477770
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s. WordPad Text Converter for Word 97 file formats could allow an attacker to execute arbitrary code on a vulnerable host.

CVE Number: CVE-2009-0087
iDefense Title: Microsoft WordPad and Office Text Converter Memory Corruption Vulnerability
iDefense Master ID: 485192
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s. WordPad and Office Text Converter could allow an attacker to execute arbitrary code on a vulnerable host.

CVE Number: CVE-2009-0088
iDefense Title: Microsoft Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability (iDefense Exclusive)
iDefense Master ID: 447588
iDefense Severity: MEDIUM

Remote exploitation of an input validation vulnerability in Microsoft Corp.'s Word 2000 WordPerfect 6.x Converter allows attackers to execute code in the context of the current user.

CVE Number: CVE-2009-0235
iDefense Title: Microsoft WordPad Word97 Converter Stack Buffer Overflow Vulnerability (iDefense Exclusive)
iDefense Master ID: 478532
iDefense Severity: MEDIUM

Remote exploitation of a stack buffer overflow vulnerability in Microsoft Corp.'s WordPad could allow an attacker to execute arbitrary code with the privileges of the current user.
 

Security Bulletin MS09-011: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (961373)
http://www.microsoft.com/technet/security/bulletin/MS09-011.mspx

CVE Number: CVE-2009-0084
iDefense Title: Microsoft DirectShow MJPEG File Format Code Execution Vulnerability
iDefense Master ID: 485190
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s DirectShow could allow an attacker to execute arbitrary code on the targeted host.
 

Security Bulletin MS09-012: Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
http://www.microsoft.com/technet/security/bulletin/MS09-012.mspx

CVE Number: CVE-2008-1436
iDefense Title: Microsoft Windows SeImpersonatePrivilege() Privilege Elevation Vulnerability
iDefense Master ID: 468868
iDefense Severity: MEDIUM

Remote exploitation of a privilege elevation vulnerability in Microsoft Corp.'s Windows versions Vista, XP SP2, 2003 and 2008 could allow authenticated attackers to elevate privileges to the local-system level.

CVE Number: CVE-2009-0078
iDefense Title: Microsoft Windows WMI Service Isolation Privilege Escalation Vulnerability
iDefense Master ID: 485191
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in WMI, within Microsoft Corp.'s Windows operating system, could allow an attacker to gain unauthorized higher privileges.

CVE Number: CVE-2009-0079
iDefense Title: Microsoft Windows RPCSS Service Isolation Privilege Escalation Vulnerability
iDefense Master ID: 485198
iDefense Severity: MEDIUM

Local exploitation of a design flaw in the RPCSS service within Microsoft Corp.'s Windows Operating System could allow an attacker to gain unauthorized higher privileges.

CVE Number: CVE-2009-0080
iDefense Title: Microsoft Windows Operating System ACL ThreadPool Privilege Escalation Vulnerability
iDefense Master ID: 485194
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s Windows operating system could allow an attacker to gain unauthorized higher privileges.
 

Security Bulletin MS09-013: Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)
http://www.microsoft.com/technet/security/bulletin/MS09-013.mspx

CVE Number: CVE-2009-0086
iDefense Title: Microsoft HTTP Services Integer Underflow Vulnerability
iDefense Master ID: 485188
iDefense Severity: HIGH

Remote exploitation of an integer underflow vulnerability in Windows HTTP Services (WinHTTP API) could allow an attacker to execute arbitrary code with the privileges of the application using the API.

CVE Number: CVE-2009-0089
iDefense Title: Microsoft HTTP Services Certificate Name Mismatch Vulnerability
iDefense Master ID: 485189
iDefense Severity: LOW

Remote exploitation of a design error vulnerability in the WinHTTP API could allow an attacker to spoof certificates.

CVE Number: CVE-2009-0550
iDefense Title: Microsoft HTTP Services NTLM Credential Reflection Vulnerability
iDefense Master ID: 485197
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s HTTP Services could allow attackers to execute arbitrary code on the targeted host under the security context of the currently logged-on user.
 

Security Bulletin MS09-014: Cumulative Security Update for Internet Explorer (963027)
http://www.microsoft.com/technet/security/bulletin/MS09-014.mspx

CVE Number: CVE-2008-2540
iDefense Title: Multiple Vendor Default Desktop Download Location Search Path Design Error Vulnerability
iDefense Master ID: 485204
iDefense Severity: MEDIUM

Remote exploitation of a design error in various versions of multiple Microsoft Corp. products could allow attackers to gain escalated privileges on the targeted host.

CVE Number: CVE-2009-0550
iDefense Title: Microsoft Internet Explorer WinINet NTLM Credential Reflection Vulnerability
iDefense Master ID: 485200
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s Internet Explorer could allow attackers to execute arbitrary code on the targeted host under the security context of the currently logged-on user.

CVE Number: CVE-2009-0551
iDefense Title: Microsoft Internet Explorer Page Transition Memory Corruption Vulnerability
iDefense Master ID: 485195
iDefense Severity: HIGH

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2009-0552
iDefense Title: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
iDefense Master ID: 485199
iDefense Severity: HIGH

Remote exploitation of an uninitialized memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code with the privileges of the current user.

CVE Number: CVE-2009-0553
iDefense Title: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
iDefense Master ID: 485196
iDefense Severity: MEDIUM

Remote exploitation of a memory corruption vulnerability of Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code on the targeted host.

CVE Number: CVE-2009-0554
iDefense Title: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
iDefense Master ID: 485202
iDefense Severity: HIGH

Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code with the privileges of the current user.
 

Security Bulletin MS09-015: Cumulative Security Update for Internet Explorer (963027)
http://www.microsoft.com/technet/security/bulletin/MS09-015.mspx

CVE Number: CVE-2008-2540
iDefense Title: Microsoft Internet Explorer Blended Threat File Loading Design Error Vulnerability
iDefense Master ID: 470185
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in multiple versions of Microsoft Corp.'s Internet Explorer could allow attackers to execute arbitrary code on the targeted host under the privileges of the current logged-on user.
 

Security Bulletin MS09-016: Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service (961759)
http://www.microsoft.com/technet/security/bulletin/MS09-016.mspx

CVE Number: CVE-2009-0077
iDefense Title: Microsoft ISA Server and Forefront Threat Management Gateway Web Proxy TCP State DoS Vulnerability
iDefense Master ID: 485193
iDefense Severity: MEDIUM

Remote exploitation of a design error vulnerability in Microsoft Corp.'s Internet Security and Acceleration (ISA) Server and Forefront Threat Management Gateway (Medium Business Edition) could allow attackers to cause a denial of service (DoS) condition on the targeted host.

CVE Number: CVE-2009-0237
iDefense Title: Microsoft ISA Server and Forefront TMG HTML Forms Authentication Component "cookieauth.dll" Input Validation Error XSS Vulnerability
iDefense Master ID: 485201
iDefense Severity: MEDIUM

Remote exploitation of an input validation error vulnerability in Microsoft Corp.'s Internet Security and Acceleration (ISA) Server and Forefront Threat Management Gateway (TMG), Medium Business Edition (MBE), could allow attackers to conduct cross-site scripting (XSS) attack leading to spoofing and information disclosure on the targeted host.