Description: Two vulnerabilities have been reported in Microsoft Office, which can be exploited by malicious people to compromise a user's system.
1) An error when parsing cells comments in Excel files can be exploited to corrupt memory via a specially crafted Excel file.
2) An unspecified error when parsing Office files can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector.
Provided and/or discovered by: 1) Reported by Arnaud Dovi via Zero Day Initiative.
2) The vendor credits an anonymous person.
Changelog: 2008-03-12: Added additional link and information provided by ZDI.
2008-04-17: Added Microsoft Word Viewer 2003 to list of affected software. Updated "Solution" section with patches for Microsoft Word Viewer 2003.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
