Install Microsoft Patches

• Vulnerabilities in Microsoft Office Powerpoint Could Allow Remote Code Execution (967340) http://www.microsoft.com/technet/security/bulletin/ms09-017.mspx
  • Microsoft Security Advisory (969136) Vulnerability in Microsoft Office PowerPoint Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/969136.mspx
  • Secunia Research: Microsoft PowerPoint Atom Parsing Buffer Overflows http://www.securityfocus.com/archive/1/503451
  • ZDI-09-019: Microsoft Office PowerPoint OutlineTextRefAtom Parsing Memory Corruption Vulnerability http://www.securityfocus.com/archive/1/503453
  • ZDI-09-020: Microsoft Office PowerPoint Notes Container Heap Overflow Vulnerability http://www.securityfocus.com/archive/1/503454
  • iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion Filter Stack Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/068990.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion Filter Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/068991.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint 4.2 Conversion Filter Stack Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/068992.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT 4.0 Importer Multiple Stack Buffer Overflow Vulnerabilities http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/068993.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT95 Import Multiple Stack Buffer Overflow Vulnerabilities http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/068995.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint PPT95 Import Multiple Stack Buffer Overflow Vulnerabilities http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/068996.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint Build List Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/068999.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint Notes Container Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/069000.html
    iDefense Security Advisory 05.12.09: Microsoft PowerPoint Integer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2009-May/069001.html
  Note that ms09-017 removes support for old PP40 format.
• Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege (959426) http://www.microsoft.com/technet/security/bulletin/ms09-015.mspx
  • Microsoft Security Advisory (953818) Blended Threat from Combined Attack Using Apple's Safari on the Windows Platform http://www.microsoft.com/technet/security/advisory/953818.mspx
    Updated 20 Jun 08 with
    About the security content of Safari 3.1.2 for Windows http://support.apple.com/kb/HT2092
    and that reportedly solves things...
    See ms09-014 also
  • Microsoft Security advisory for Safari and Windows http://isc.sans.org/diary.html?storyid=4495
  • Safari Carpet Bomb http://www.oreillynet.com/onlamp/blog/2008/05/safari_carpet_bomb.html
  • Safari pwns Internet Explorer http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx
• Cumulative Security Update for Internet Explorer (963027) http://www.microsoft.com/technet/security/bulletin/ms09-014.mspx
• Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803) http://www.microsoft.com/technet/security/bulletin/ms09-013.mspx
• Vulnerabilities in Windows Could Allow Elevation of Privilege (959454) http://www.microsoft.com/technet/security/bulletin/ms09-012.mspx
  • Microsoft Security Advisory (951306) Vulnerability in Windows Could Allow Elevation of Privilege http://www.microsoft.com/technet/security/advisory/951306.mspx
  • Token Kidnapping (Microsoft Security Advisory 951306) presentation available http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061634.html
  • Token Kidnapping Windows 2003 PoC exploit http://www.securityfocus.com/archive/1/497168
• Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (961373) http://www.microsoft.com/technet/security/bulletin/ms09-011.mspx
• Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477) http://www.microsoft.com/technet/security/bulletin/ms09-010.mspx
  • Microsoft Security Advisory (960906) Vulnerability in WordPad Text Converter Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/960906.mspx
  • iDefense Security Advisory 04.14.09: Microsoft Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2009-April/068700.html
• Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557) http://www.microsoft.com/technet/security/bulletin/ms09-009.mspx
  • Microsoft Security Advisory (968272) Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/968272.mspx
• Vulnerability in SChannel Could Allow Spoofing (960225) http://www.microsoft.com/technet/security/bulletin/ms09-007.mspx
• Vulnerabilities in Windows Kernel Could Allow Remote Code Execution (958690) http://www.microsoft.com/technet/security/bulletin/ms09-006.mspx
• Behavior of ActiveX controls embedded in Office documents http://blogs.technet.com/srd/archive/2009/03/03/behavior-of-activex-controls-embedded-in-office-documents.aspx
• Microsoft Security Advisory (967940) Update for Windows Autorun http://www.microsoft.com/technet/security/advisory/967940.mspx
• Vulnerabilities in Microsoft Office Visio Could Allow Remote Code Execution (957634) http://www.microsoft.com/technet/security/bulletin/ms09-005.mspx
• Cumulative Security Update for Internet Explorer (961260) http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx
• Microsoft Security Advisory (960715) Update Rollup for ActiveX Kill Bits http://www.microsoft.com/technet/security/advisory/960715.mspx
• Microsoft Security Bulletin MS09-001 - Critical - Vulnerabilities in SMB Could Allow Remote Code Execution (958687) http://www.microsoft.com/technet/security/bulletin/ms09-001.mspx
• Microsoft Security Bulletin MS08-078 - Critical Security Update for Internet Explorer (960714) http://www.microsoft.com/technet/security/bulletin/ms08-078.mspx
  • Microsoft Security Advisory (961051) Vulnerability in Internet Explorer Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/961051.mspx
  • http://blogs.technet.com/swi/archive/2008/12/12/Clarification-on-the-various-workarounds-from-the-recent-IE-advisory.aspx
  • http://blogs.msdn.com/sdl/archive/2008/12/18/ms08-078-and-the-sdl.aspx
  • 0-day exploit for Internet Explorer in the wild http://isc.sans.org/diary.html?storyid=5458
    MSIE 0-day Spreading Via SQL Injection http://isc.sans.org/diary.html?storyid=5464
    IE7 0day expanded to include IE6 and IE8(beta) http://isc.sans.org/diary.html?storyid=5470
    XML data Island workaround may affect clients wth exchange 2003 outlook web access http://isc.sans.org/diary.html?storyid=5503
  • MS Internet Explorer XML Parsing Remote Buffer Overflow Exploit 0day http://milw0rm.com/exploits/7403
    MS Internet Explorer XML Parsing Buffer Overflow Exploit (vista) 0day http://milw0rm.com/exploits/7410
• Vulnerability in Microsoft Office SharePoint Server Could Cause Elevation of Privilege (957175) http://www.microsoft.com/technet/security/bulletin/ms08-077.mspx
• Vulnerabilities in Windows Media Components Could Allow Remote Code Execution (959807) http://www.microsoft.com/technet/security/bulletin/ms08-076.mspx
• Vulnerabilities in Windows Search Could Allow Remote Code Execution (959349) http://www.microsoft.com/technet/security/bulletin/ms08-075.mspx
• Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (959070) http://www.microsoft.com/technet/security/bulletin/ms08-074.mspx
  Updated 28 Jan 09.
• Cumulative Security Update for Internet Explorer (958215) http://www.microsoft.com/technet/security/bulletin/ms08-073.mspx
• Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution(957173) http://www.microsoft.com/technet/security/bulletin/ms08-072.mspx
• Vulnerabilities in GDI Could Allow Remote Code Execution(956802) http://www.microsoft.com/technet/security/bulletin/ms08-071.mspx
• Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) Could Allow Remote Code Execution(932349) http://www.microsoft.com/technet/security/bulletin/ms08-070.mspx
• Microsoft Security Advisory (953839) Cumulative Security Update of ActiveX Kill Bits http://www.microsoft.com/technet/security/advisory/953839.mspx
• Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (955218) http://www.microsoft.com/technet/security/bulletin/ms08-069.mspx
• Vulnerability in SMB Could Allow Remote Code Execution (957097) http://www.microsoft.com/technet/security/bulletin/ms08-068.mspx
  Issue is 7 or 12 years old, and patch does not protect fully:
  • MS08-068 and SMBRelay http://blogs.technet.com/msrc/archive/2008/11/11/ms08-068-and-smbrelay.aspx
  • http://en.wikipedia.org/wiki/SMBRelay
  • The SMB Man-In-the-Middle Attack http://www.xfocus.net/articles/200305/smbrelay.html
  • SmbRelay captures NTLM hashes http://www.windowsnetworking.com/kbase/WindowsTips/WindowsXP/AdminTips/Network/SmbRelaycapturesNTLMhashes.html
  • MS08-068: Metasploit and SMB Relay http://blog.metasploit.com/2008/11/ms08-067-metasploit-and-smb-relay.html
  • NTLM Multiprotocol Replay attacks http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065641.html http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065651.html
• Vulnerability in Server Service Could Allow Remote Code Execution (958644) http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx
• Microsoft Security Advisory (956391) Cumulative Security Update of ActiveX Kill Bits http://www.microsoft.com/technet/security/advisory/956391.mspx
  Updated 12 Nov 08.
• Vulnerability in the Microsoft Ancillary Function Driver Could Allow Elevation of Privilege (956803) http://www.microsoft.com/technet/security/bulletin/ms08-066.mspx
  • Exploit for MS08-066 - AFD.sys kernel memory overwrite. http://www.securityfocus.com/archive/1/497375
• Vulnerability in Message Queuing Could Allow Remote Code Execution (951071) http://www.microsoft.com/technet/security/bulletin/ms08-065.mspx
  • TPTI-08-07: Microsoft Windows Message Queuing Service Heap Overflow and Memory Disclosure Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/065080.html
• Vulnerability in Virtual Address Descriptor Manipulation Could Allow Elevation of Privilege (956841) http://www.microsoft.com/technet/security/bulletin/ms08-064.mspx
• Vulnerability in SMB Could Allow Remote Code Execution (957095) http://www.microsoft.com/technet/security/bulletin/ms08-063.mspx
• Vulnerability in Windows Internet Printing Service Could Allow Remote Code Execution (953155) http://www.microsoft.com/technet/security/bulletin/ms08-062.mspx
• Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (954211) http://www.microsoft.com/technet/security/bulletin/ms08-061.mspx
• Cumulative Security Update for Internet Explorer (956390) http://www.microsoft.com/technet/security/bulletin/ms08-058.mspx
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (956416) http://www.microsoft.com/technet/security/bulletin/ms08-057.mspx
  • iDefense Security Advisory 10.14.08: Microsoft Visual Basic for Applications - Multiple Vulnerabilities http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/065078.html
• Vulnerability in Microsoft Office Could Allow Information Disclosure (957699) http://www.microsoft.com/technet/security/bulletin/ms08-056.mspx
• Vulnerability in Microsoft Office Could Allow Remote Code Execution (955047) http://www.microsoft.com/technet/security/bulletin/ms08-055.mspx
  • Insomnia : ISVA-080910.1 - MS Office OneNote URL Handling Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064335.html
• Vulnerability in Windows Media Player Could Allow Remote Code Execution (954154) http://www.microsoft.com/technet/security/bulletin/ms08-054.mspx
• Vulnerability in Windows Media Encoder 9 Could Allow Remote Code Execution (954156) http://www.microsoft.com/technet/security/bulletin/ms08-053.mspx
• Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593) http://www.microsoft.com/technet/security/bulletin/ms08-052.mspx
  • Assurent VR - Microsoft Windows Graphics Rendering Engine WMF Parsing Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064334.html
  • ZDI-08-055: Microsoft Windows GDI+ BMP Parsing Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064320.html
    ZDI-08-056: Microsoft Windows GDI+ GIF Parsing Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064319.html
  • iDefense Security Advisory 09.09.08: Microsoft Windows GDI+ Gradient Fill Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064328.html
• Microsoft Security Advisory (953839) Cumulative Security Update of ActiveX Kill Bits http://www.microsoft.com/technet/security/advisory/953839.mspx
• Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (949785) http://www.microsoft.com/technet/security/bulletin/ms08-051.mspx
  • iDefense Security Advisory 08.12.08: Microsoft PowerPoint Viewer 2003 Out of Bounds Array Index Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063883.html
  • iDefense Security Advisory 08.12.08: Microsoft PowerPoint Viewer 2003 Cstring Integer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063884.html
• Vulnerability in Windows Messenger Could Allow Information Disclosure (955702) http://www.microsoft.com/technet/security/bulletin/ms08-050.mspx
  • Microsoft Windows Messenger Remote Illegal Access Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063903.html
• Vulnerability in Event System Could Allow Remote Code Execution (950974) http://www.microsoft.com/technet/security/bulletin/ms08-049.mspx
• Security Update for Outlook Express and Windows Mail (951066) http://www.microsoft.com/technet/security/bulletin/ms08-048.mspx
  • CORE-2008-0103: Internet Explorer Zone Elevation Restrictions Bypass and Security Zone Restrictions Bypass http://www.securityfocus.com/archive/1/495458
• Vulnerability in IPsec Policy Processing Could Allow Information Disclosure (953733) http://www.microsoft.com/technet/security/bulletin/ms08-047.mspx
• Vulnerability in Microsoft Windows Image Color Management System Could Allow Remote Code Execution (952954) http://www.microsoft.com/technet/security/bulletin/ms08-046.mspx
  • iDefense Security Advisory 08.12.08: Microsoft Windows Color Management Module Heap Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063887.html
• Cumulative Security Update for Internet Explorer (953838) http://www.microsoft.com/technet/security/bulletin/ms08-045.mspx
  • ZDI-08-050: Microsoft Internet Explorer XHTML Rendering Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063876.html
  • ZDI-08-051: Microsoft Internet Explorer Table Layout Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063877.html
• Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution (924090) http://www.microsoft.com/technet/security/bulletin/ms08-044.mspx
  • ZDI-08-049: Microsoft Windows Graphics Rendering Engine PICT Heap Corruption http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063875.html
  • iDefense Security Advisory 08.12.08: Microsoft Office BMP Input Filter Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063879.html
  • iDefense Security Advisory 08.12.08: Microsoft Office WPG Image File Heap Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063882.html
  • iDefense Security Advisory 08.12.08: Microsoft Excel FORMAT Record Invalid Array Index Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063886.html
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (954066) http://www.microsoft.com/technet/security/bulletin/ms08-043.mspx
  • ZDI-08-048: Microsoft Excel COUNTRY Record Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063874.html
  • iDefense Security Advisory 08.12.08: Microsoft Excel Chart AxesSet Invalid Array Index Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/063885.html
• Vulnerability in Microsoft Word Could Allow Remote Code Execution (955048) http://www.microsoft.com/technet/security/bulletin/ms08-042.mspx
  • Microsoft Security Advisory (953635) Vulnerability in Microsoft Word Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/953635.mspx
• Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access Could Allow Remote Code Execution (955617) http://www.microsoft.com/technet/security/bulletin/ms08-041.mspx
• Vulnerability in Windows Explorer Could Allow Remote Code Execution (950582) http://www.microsoft.com/technet/security/bulletin/ms08-038.mspx
• Vulnerabilities in DNS Could Allow Spoofing (953230) http://www.microsoft.com/technet/security/bulletin/ms08-037.mspx
  Revised 10 Jul 08 with ZoneAlarm and CheckPoint info.
  See also:
  • DNS and NAT (was: DNS and CheckPoint) http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063165.html http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063168.html
  • Critical DNS Flaw - Have You Fixed It? https://www.sans.org/newsletters/newsbites/newsbites.php?vol=10&issue=54#sID200
• Microsoft Security Advisory (955179) Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/955179.mspx
• Microsoft Security Advisory (954960) Microsoft Windows Server Update Services (WSUS) Blocked from Deploying Security Updates http://www.microsoft.com/technet/security/advisory/954960.mspx
• Microsoft Security Advisory (954474) System Center Configuration Manager 2007 Blocked from Deploying Security Updates http://www.microsoft.com/technet/security/advisory/954474.mspx
• Vulnerabilities in Pragmatic General Multicast (PGM) Could Allow Denial of Service (950762) http://www.microsoft.com/technet/security/bulletin/ms08-036.mspx
• Vulnerability in Active Directory Could Allow Denial of Service (953235) http://www.microsoft.com/technet/security/bulletin/ms08-035.mspx
• Vulnerability in WINS Could Allow Elevation of Privilege (948745) http://www.microsoft.com/technet/security/bulletin/ms08-034.mspx
• Vulnerabilities in DirectX Could Allow Remote Code Execution (951698) http://www.microsoft.com/technet/security/bulletin/ms08-033.mspx
  • ZDI-08-040: Microsoft DirectX SAMI File Format Name Parsing Stack Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-June/062751.html
• Cumulative Security Update of ActiveX Kill Bits (950760) http://www.microsoft.com/technet/security/bulletin/ms08-032.mspx
• Cumulative Security Update for Internet Explorer (950759) http://www.microsoft.com/technet/security/bulletin/ms08-031.mspx
  • ZDI-08-039: Microsoft Internet Explorer DOM Ojbect substringData() Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-June/062750.html
• Vulnerability in Bluetooth Stack Could Allow Remote Code Execution (951376) http://www.microsoft.com/technet/security/bulletin/ms08-030.mspx
  Re-released 19 Jun 08.
• (This is not an MS issue, but where to put it?)
  CSIS-RI-0003: Multiple buffer overflow vulnerabilities in HP ActiveX http://lists.grok.org.uk/pipermail/full-disclosure/2008-June/062641.html
• Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service (952044) http://www.microsoft.com/technet/security/bulletin/ms08-029.mspx
• Vulnerability in Microsoft Jet Database Engine Could Allow Remote Code Execution (950749) http://www.microsoft.com/technet/security/bulletin/ms08-028.mspx
  • Microsoft Security Advisory (950627) Vulnerability in Microsoft Jet Database Engine (Jet) Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/950627.mspx
  • UPDATE: MSRC Blog: Microsoft Security Advisory (950627) http://blogs.technet.com/msrc/archive/2008/03/24/update-msrc-blog-microsoft-security-advisory-950627.aspx
  • TPTI-08-04: Microsoft Office Jet Database Engine Column Parsing Stack Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062285.html
• Vulnerability in Microsoft Publisher Could Allow Remote Code Execution (951208) http://www.microsoft.com/technet/security/bulletin/ms08-027.mspx
  • Microsoft Office Publisher PUB File Parsing Remote Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062295.html
• Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (951207) http://www.microsoft.com/technet/security/bulletin/ms08-026.mspx
  • MS08-026: How to prevent Word from loading RTF files http://blogs.technet.com/swi/archive/2008/05/13/file-block-and-ms08-026.aspx
  • ZDI-08-023: Microsoft Office RTF Parsing Engine Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062286.html
  • iDefense Security Advisory 05.13.08: Microsoft Word CSS Processing Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062287.html
• Release notes for Windows XP Service Pack 3 http://support.microsoft.com/kb/936929
  • AusCERT Update AU-2008.0009 -- Microsoft XP Service Pack 3 Includes Vulnerable Flash Player http://www.auscert.org.au/9388
  • See also ms06-078 ms07-068 .
• (This is not an MS issue, but where to put it?)
  AusCERT Advisory AA-2008.0098 -- RealTek HD Audio Codec Driver Local Privilege Escalation http://www.auscert.org.au/9210
• Vulnerability in Windows Kernel Could Allow Elevation of Privilege (941693) http://www.microsoft.com/technet/security/bulletin/ms08-025.mspx
• Cumulative Security Update for Internet Explorer (947864) http://www.microsoft.com/technet/security/bulletin/ms08-024.mspx
• Security Update of ActiveX Kill Bits (948881) http://www.microsoft.com/technet/security/bulletin/ms08-023.mspx
  • iDefense Security Advisory 04.08.08: Microsoft HxTocCtrl ActiveX Control Invalid Param Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061290.html
• Vulnerability in VBScript and JScript Scripting Engines Could Allow Remote Code Execution (944338) http://www.microsoft.com/technet/security/bulletin/ms08-022.mspx
• Vulnerabilities in GDI Could Allow Remote Code Execution (948590) http://www.microsoft.com/technet/security/bulletin/ms08-021.mspx
  • ZDI-08-020: Microsoft GDI WMF Parsing Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061278.html
  • iDefense Security Advisory 04.08.08: Microsoft Windows Graphics Rendering Engine Integer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061298.html
    iDefense Security Advisory 04.08.08: Microsoft Windows Graphics Rendering Engine Heap Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061299.html
• Vulnerability in DNS Client Could Allow Spoofing (945553) http://www.microsoft.com/technet/security/bulletin/ms08-020.mspx
  • Microsoft Windows DNS Stub Resolver Cache Poisoning (MS08-020) http://www.securityfocus.com/archive/1/490575
  • Microsoft SWI blog inaccuracies http://www.securityfocus.com/archive/1/491392
• Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (949032) http://www.microsoft.com/technet/security/bulletin/ms08-019.mspx
• Vulnerability in Microsoft Project Could Allow Remote Code Execution (950183) http://www.microsoft.com/technet/security/bulletin/ms08-018.mspx
• Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (933103) http://www.microsoft.com/technet/security/bulletin/ms08-017.mspx
• Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (949030) http://www.microsoft.com/technet/security/bulletin/ms08-016.mspx
  • ZDI-08-008: Microsoft Excel BIFF File Format Cell Record Parsing Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060692.html
• Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (949031) http://www.microsoft.com/technet/security/bulletin/ms08-015.mspx
  • iDefense Security Advisory 03.11.08: Microsoft Outlook mailto Command Line Switch Injection http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060698.html
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (949029) http://www.microsoft.com/technet/security/bulletin/ms08-014.mspx
  Re-released 19 Mar 08: http://support.microsoft.com/kb/950340/
  • Microsoft Security Advisory (947563) Vulnerability in Microsoft Excel Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/947563.mspx
  • iDefense Security Advisory 03.11.08: Microsoft Excel DVAL Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060696.html
  • iDefense Security Advisory 03.11.08: Microsoft Excel 2003 Malformed Formula Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060697.html
  • TPTI-08-03: Microsoft Excel Rich Text Memory Corruption Vulnerability http://www.securityfocus.com/archive/1/489430
• Vulnerability in Microsoft Office Could Allow Remote Code Execution (947108) http://www.microsoft.com/technet/security/bulletin/ms08-013.mspx
• Vulnerabilities in Microsoft Office Publisher Could Allow Remote Code Execution (947085) http://www.microsoft.com/technet/security/bulletin/ms08-012.mspx
• Vulnerabilities in Microsoft Works File Converter Could Allow Remote Code Execution (947081) http://www.microsoft.com/technet/security/bulletin/ms08-011.mspx
  • MS08-011/CVE-2008-0108 exploit. http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060308.html
• Cumulative Security Update for Internet Explorer (944533) http://www.microsoft.com/technet/security/bulletin/ms08-010.mspx
• Vulnerability in Microsoft Word Could Allow Remote Code Execution (947077) http://www.microsoft.com/technet/security/bulletin/ms08-009.mspx
• Vulnerability in OLE Automation Could Allow Remote Code Execution (947890) http://www.microsoft.com/technet/security/bulletin/ms08-008.mspx
• Vulnerability in WebDAV Mini-Redirector Could Allow Remote Code Execution (946026) http://www.microsoft.com/technet/security/bulletin/ms08-007.mspx
• Vulnerability in Windows TCP/IP Could Allow Denial of Service (946456) http://www.microsoft.com/technet/security/bulletin/ms08-004.mspx
• Vulnerability in Active Directory Could Allow Denial of Service (946538) http://www.microsoft.com/technet/security/bulletin/ms08-003.mspx
• Microsoft Security Advisory (943411) Update to Improve Windows Sidebar Protection http://www.microsoft.com/technet/security/advisory/943411.mspx
• Vulnerability in LSASS Could Allow Local Elevation of Privilege (943485) http://www.microsoft.com/technet/security/bulletin/ms08-002.mspx
• Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (941644) http://www.microsoft.com/technet/security/bulletin/ms08-001.mspx
• Cumulative Security Update for Internet Explorer (942615) http://www.microsoft.com/technet/security/bulletin/ms07-069.mspx
  MS07-069 Cumulative Security Update for Internet Explorer - Post Install Issue http://blogs.technet.com/msrc/archive/2007/12/18/ms07-069-cumulative-security-update-for-internet-explorer-post-install-issue.aspx
  Internet Explorer 6 crashes after you install security update 942615 on a computer that is running Windows XP Service Pack 2 http://support.microsoft.com/kb/946627
  • ZDI-07-073: Microsoft Internet Explorer setExpression Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059040.html
  • ZDI-07-074: Microsoft Internet Explorer Node Manipulation Memory Corruption http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059041.html
  • ZDI-07-075: Microsoft Internet Explorer Element Tags Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059043.html
  • iDefense Security Advisory 12.11.07: Microsoft Internet Explorer JavaScript setExpression Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059081.html
• Vulnerability in Windows Media File Format Could Allow Remote Code Execution (941569 and 944275) http://www.microsoft.com/technet/security/bulletin/ms07-068.mspx
• Vulnerability in Macrovision Driver Could Allow Local Elevation of Privilege (944653) http://www.microsoft.com/technet/security/bulletin/ms07-067.mspx
  • Microsoft Security Advisory (944653) Vulnerability in Macrovision SECDRV.SYS Driver on Windows Could Allow Elevation of Privilege http://www.microsoft.com/technet/security/advisory/944653.mspx
• (Vista) Vulnerability in Windows Kernel Could Allow Elevation of Privilege (943078) http://www.microsoft.com/technet/security/bulletin/ms07-066.mspx
• Vulnerability in Message Queuing Could Allow Remote Code Execution (937894) http://www.microsoft.com/technet/security/bulletin/ms07-065.mspx
  • ZDI-07-076: Microsoft Windows Message Queuing Service Stack Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059042.html
• Vulnerabilities in DirectX Could Allow Remote Code Execution (941568) http://www.microsoft.com/technet/security/bulletin/ms07-064.mspx
  • iDefense Security Advisory 12.11.07: Microsoft DirectX 7 and 8 DirectShow Stack Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059083.html
• (Vista) Vulnerability in SMBv2 Could Allow Remote Code Execution (942624) http://www.microsoft.com/technet/security/bulletin/ms07-063.mspx
• Microsoft Security Advisory (945713) Vulnerability in Web Proxy Auto-Discovery (WPAD) Could Allow Information Disclosure http://www.microsoft.com/technet/security/advisory/945713.mspx
  • Microsoft sends out security over bug scare http://www.smh.com.au/news/security/microsoft-sends-out-security-over-bug-scare/2007/12/03/1196530575355.html
  • [dns-operations] Web Proxy Auto-Discovery (WPAD) Information Disclosure (fwd) http://www.securityfocus.com/archive/1/484559 http://lists.oarci.net/pipermail/dns-operations/2007-December/002160.html
• Vulnerability in Windows URI Handling Could Allow Remote Code Execution (943460) http://www.microsoft.com/technet/security/bulletin/ms07-061.mspx
  • Microsoft Security Advisory (943521) URL Handling Vulnerability in Windows XP and Windows Server 2003 with Windows Internet Explorer 7 Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/943521.mspx
  • MSRC Blog: Additional Details and Background on Security Advisory 943521 http://blogs.technet.com/msrc/archive/2007/10/10/msrc-blog-additional-details-and-background-on-security-advisory-943521.aspx
  • MSRC Blog: October 25th Update To Security Advisory 943521 http://blogs.technet.com/msrc/archive/2007/10/25/msrc-blog-october-25th-update-to-security-advisory-943521.aspx
  • Third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling) available http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066638.html
• Vulnerability in Microsoft Word Could Allow Remote Code Execution (942695) http://www.microsoft.com/technet/security/bulletin/ms07-060.mspx
• Vulnerability in RPC Could Allow Denial of Service (933729) http://www.microsoft.com/technet/security/bulletin/ms07-058.mspx
  • ZDI-07-055: Microsoft Windows DCERPC Authentication Denial of Service Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066507.html
• Cumulative Security Update for Internet Explorer (939653) http://www.microsoft.com/technet/security/bulletin/ms07-057.mspx
• Security Update for Outlook Express and Windows Mail (941202) http://www.microsoft.com/technet/security/bulletin/ms07-056.mspx
  • iDefense Security Advisory 10.09.07: Microsoft Windows Mail and Outlook Express NNTP Protocol Heap Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066439.html
• Vulnerability in Kodak Image Viewer Could Allow Remote Code Execution (923810) http://www.microsoft.com/technet/security/bulletin/ms07-055.mspx
• Vulnerability in MSN Messenger and Windows Live Messenger could allow Remote Code Execution (942099) http://www.microsoft.com/technet/security/bulletin/ms07-054.mspx
• Vulnerability in Windows Services for UNIX Could Allow Elevation of Privilege (939778) http://www.microsoft.com/technet/security/bulletin/ms07-053.mspx
• Vulnerability in Crystal Reports for Visual Studio Could Allow Remote Code Execution (941522) http://www.microsoft.com/technet/security/bulletin/ms07-052.mspx
• Vulnerability in Microsoft Agent Could Allow Remote Code Execution (938827) http://www.microsoft.com/technet/security/bulletin/ms07-051.mspx
  • iDefense Security Advisory 09.11.07: Microsoft Windows 2000 Agent URL Canonicalizing Stack Based Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065719.html
  • Assurent VR - Microsoft Agent Crafted URL Stack Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065713.html
• Vulnerability in Vector Markup Language Could Allow Remote Code Execution (938127) http://www.microsoft.com/technet/security/bulletin/ms07-050.mspx
  • EEYE: VGX.DLL Compressed Content Heap Overflow Vulnerability http://www.securityfocus.com/archive/1/476498
• Vulnerabilities in Windows Gadgets Could Allow Remote Code Execution (938123) http://www.microsoft.com/technet/security/bulletin/ms07-048.mspx
  • Next generation malware: Windows Vista's gadget API http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065763.html
  • iDefense Security Advisory 08.14.07: Microsoft Windows Vista Sidebar RSS Feeds Gadget Cross Site Scripting Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065273.html
• Vulnerabilities in Windows Media Player Could Allow Remote Code Execution (936782) http://www.microsoft.com/technet/security/bulletin/ms07-047.mspx
  • ZDI-07-046: Microsoft Windows Media Player Skin Parsing Size Mismatch Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065268.html
  • ZDI-07-047: Microsoft Windows Media Player Malformed Skin Header Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065269.html
• Vulnerability in GDI Could Allow Remote Code Execution (938829) http://www.microsoft.com/technet/security/bulletin/ms07-046.mspx
  • EEYE: Windows Metafile AttemptWrite Heap Overflow http://www.securityfocus.com/archive/1/476505
• Cumulative Security Update for Internet Explorer (937143) http://www.microsoft.com/technet/security/bulletin/ms07-045.mspx
  • TlbInf32 ActiveX Command Execution http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065305.html
• Vulnerability in Microsoft Excel Could Allow Remote Code Execution (940965) http://www.microsoft.com/technet/security/bulletin/ms07-044.mspx
  • Technical Tips and Insights on MS07-049 and MS07-044 http://blogs.technet.com/msrc/archive/2007/08/23/technical-tips-and-insights-on-ms07-049-and-ms07-044.aspx
• Vulnerability in OLE Automation Could Allow Remote Code Execution (921503) http://www.microsoft.com/technet/security/bulletin/ms07-043.mspx
• Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (936227) http://www.microsoft.com/technet/security/bulletin/ms07-042.mspx
  Re-released 28 Sep 07, 9 Jan 08, 24 Jun 08.
  • ZDI-07-048: Microsoft Internet Explorer substringData() Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065270.html
  • iDefense Security Advisory 08.14.07: Microsoft XML Core Services XMLDOM Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065272.html
• Microsoft Security Advisory (932596) Update to Improve Kernel Patch Protection http://www.microsoft.com/technet/security/advisory/932596.mspx
• Vulnerabilities in .NET Framework Could Allow Remote Code Execution (931212) http://www.microsoft.com/technet/security/bulletin/ms07-040.mspx
  • Multiple .NET Null Byte Injection Vulnerabilities http://www.securityfocus.com/archive/1/473308
• Vulnerability in Windows Vista Firewall Could Allow Information Disclosure (935807) http://www.microsoft.com/technet/security/bulletin/ms07-038.mspx
  Re-released 15 Aug 07.
  • SYMSA-2007-005: Vista Windows Firewall Incorrectly Applies Filtering to Teredo Interface http://www.securityfocus.com/archive/1/473294
• Vulnerability in Microsoft Office Publisher 2007 Could Allow Remote Code Execution (936548) http://www.microsoft.com/technet/security/bulletin/ms07-037.mspx
  • EEYE: Microsoft Publisher 2007 Arbitrary Pointer Dereference http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064538.html
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (936542) http://www.microsoft.com/technet/security/bulletin/ms07-036.mspx
• Vulnerability in Win 32 API Could Allow Remote Code Execution (935839) http://www.microsoft.com/technet/security/bulletin/ms07-035.mspx
• Cumulative Security Update for Outlook Express and Windows Mail (929123) http://www.microsoft.com/technet/security/bulletin/ms07-034.mspx
  • MS07-034: Executing arbitrary script with mhtml: protocol handler http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/064131.html
• Cumulative Security Update for Internet Explorer (933566) http://www.microsoft.com/technet/security/bulletin/ms07-033.mspx
  • ZDI-07-037: Microsoft Internet Explorer Language Pack Installation Remote Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063944.html
  • ZDI-07-038: Microsoft Internet Explorer Prototype Dereference Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063945.html
  • iDefense Security Advisory 06.12.07: Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063946.html
• Vulnerability in Windows Vista Could Allow Information Disclosure (931213) http://www.microsoft.com/technet/security/bulletin/ms07-032.mspx
• Vulnerability in the Windows Schannel Security Package Could Allow Remote Code Execution (935840) http://www.microsoft.com/technet/security/bulletin/ms07-031.mspx
  • Windows Oday release [SChannel Off-By-One Heap Corruption] http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063948.html
• Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (927051) http://www.microsoft.com/technet/security/bulletin/ms07-030.mspx
• Microsoft Security Advisory (927891) Update for Windows Installer (MSI) http://www.microsoft.com/technet/security/advisory/927891.mspx
• Microsoft Security Advisory (937696) Release of Microsoft Office Isolated Conversion Environment (MOICE) and File Block Functionality for Microsoft Office http://www.microsoft.com/technet/security/advisory/937696.mspx
• Cumulative Security Update for Internet Explorer (931768) http://www.microsoft.com/technet/security/bulletin/ms07-027.mspx
  • ZDI-07-027: Microsoft Internet Explorer Table Column Deletion Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063227.html
  • Secunia Research: Internet Explorer HTML Objects Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063254.html
• Vulnerability in Microsoft Office Could Allow Remote Code Execution (934873) http://www.microsoft.com/technet/security/bulletin/ms07-025.mspx
• Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (934232) http://www.microsoft.com/technet/security/bulletin/ms07-024.mspx
  • Microsoft Security Advisory (933052) Vulnerability in Microsoft Word Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/933052.mspx
  • iDefense Security Advisory 05.08.07: Microsoft Word RTF File Parsing Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063245.html
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (934233) http://www.microsoft.com/technet/security/bulletin/ms07-023.mspx
  • ZDI-07-026: Microsoft Excel BIFF File Format Named Graph Record Parsing Stack Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063226.html
  • iDefense Security Advisory 05.08.07: Microsoft Excel Filter Record Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063244.html
• Vulnerability in Windows Kernel Could Allow Elevation of Privilege (931784) http://www.microsoft.com/technet/security/bulletin/ms07-022.mspx
  • EEYE: Windows VDM Zero Page Race Condition Privilege Escalation http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053673.html
• Vulnerabilities in CSRSS Could Allow Remote Code Execution (930178) http://www.microsoft.com/technet/security/bulletin/ms07-021.mspx
  • Microsoft Windows XP/2003/Vista memory corruption 0day http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051394.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051410.html http://blogs.technet.com/msrc/archive/2006/12/22/new-report-of-a-windows-vulnerability.aspx
    NtRaiseHardError Csrss.exe memory Disclosure exploit http://www.securityfocus.com/archive/1/455365
    csrss.exe double-free vulnerability - arbitrary DWORD overwrite exploit http://www.securityfocus.com/archive/1/455546
  • EEYE: Windows Vista CSRSS Dangling Process Pointer Privilege Escalation http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053672.html
• Vulnerability in Microsoft Agent Could Allow Remote Code Execution (932168) http://www.microsoft.com/technet/security/bulletin/ms07-020.mspx
  • Secunia Research: Microsoft Agent URL Parsing Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053694.html
• Vulnerability in Universal Plug and Play Could Allow Remote Code Execution (931261) http://www.microsoft.com/technet/security/bulletin/ms07-019.mspx
  • iDefense Security Advisory 04.10.07: Microsoft Windows Universal Plug and Play Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053674.html
• Vulnerabilities in GDI Could Allow Remote Code Execution (925902) http://www.microsoft.com/technet/security/bulletin/ms07-017.mspx
  • Microsoft Security Advisory (935423) Vulnerability in Windows Animated Cursor Handling http://www.microsoft.com/technet/security/advisory/935423.mspx
  • Update on Microsoft Security Advisory 935423 http://blogs.technet.com/msrc/archive/2007/03/30/update-on-microsoft-security-advisory-935423.aspx
  • 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053269.html http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053292.html http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053303.html
  • ANI Zeroday, Third Party Patch http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053271.html
    Windows XP/Vista (.ANI) Remote Exploit (bypass eeye patch) http://www.securityfocus.com/archive/1/464475
  • More information on ZERT patch for ANI 0day http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053369.html
  • iDefense Security Advisory 04.03.07: Microsoft Windows WMF Triggerable Kernel Design Error DoS Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053415.html
• Cumulative Security Update for Internet Explorer (928090) http://www.microsoft.com/technet/security/bulletin/ms07-016.mspx
  • iDefense Security Advisory 02.13.07: Microsoft 'wininet.dll' FTP Reply Null Termination Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052397.html
• Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (932554) http://www.microsoft.com/technet/security/bulletin/ms07-015.mspx
  • Microsoft Security Advisory (932553) Vulnerability in Microsoft Office Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/932553.mspx
• Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (929434) http://www.microsoft.com/technet/security/bulletin/ms07-014.mspx
  • Microsoft Security Advisory (929433) Vulnerability in Microsoft Word Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/929433.mspx
    Microsoft Word 0-day Vulnerability FAQ - December 2006, CVE-2006-5994 http://blogs.securiteam.com/?p=759
  • New Report of A Word Zero Day http://blogs.technet.com/msrc/archive/2006/12/10/new-report-of-a-word-zero-day.aspx
    Another new Word 0-day, information & dat released by McAfee http://isc.sans.org/diary.php?storyid=1925
  • Microsoft Security Advisory (932114) Vulnerability in Microsoft Word 2000 Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/932114.mspx
• Vulnerability in Microsoft RichEdit Could Allow Remote Code Execution (918118) http://www.microsoft.com/technet/security/bulletin/ms07-013.mspx
• Vulnerability in Microsoft MFC Could Allow Remote Code Execution (924667) http://www.microsoft.com/technet/security/bulletin/ms07-012.mspx
  Re-released 13 Jun 07.
  • MS07-012 Not Fixed http://www.securityfocus.com/archive/1/463009
• Vulnerability in Microsoft OLE Dialog Could Allow Remote Code Execution (926436) http://www.microsoft.com/technet/security/bulletin/ms07-011.mspx
• Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution (932135) http://www.microsoft.com/technet/security/bulletin/ms07-010.mspx
• Vulnerability in Microsoft Data Access Components Could Allow Remote Code Execution (927779) http://www.microsoft.com/technet/security/bulletin/ms07-009.mspx
  • VU#589272 ADODB.Connection ActiveX control unspecified vulnerability http://www.kb.cert.org/vuls/id/589272
• Vulnerability in HTML Help ActiveX Control Could Allow Remote Code Execution (928843) http://www.microsoft.com/technet/security/bulletin/ms07-008.mspx
• Vulnerability in Windows Image Acquisition Service Could Allow Elevation of Privilege (927802) http://www.microsoft.com/technet/security/bulletin/ms07-007.mspx
• Vulnerability in Windows Shell Could Allow Elevation of Privilege (928255) http://www.microsoft.com/technet/security/bulletin/ms07-006.mspx
• Vulnerability in Step-by-Step Interactive Training Could Allow Remote Code Execution (923723) http://www.microsoft.com/technet/security/bulletin/ms07-005.mspx
  • MS Interactive Training .cbo Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052428.html
• The computer may respond very slowly as the Phishing Filter evaluates Web page contents in Internet Explorer 7 http://support.microsoft.com/kb/928089
• Vulnerability in Vector Markup Language Could Allow Remote Code Execution (929969) http://www.microsoft.com/technet/security/bulletin/ms07-004.mspx
  • iDefense Security Advisory 01.09.07: Multiple Microsoft Products VML 'recolorinfo' Element Integer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051694.html
• Vulnerabilities in Microsoft Outlook Could Allow Remote Code Execution (925938) http://www.microsoft.com/technet/security/bulletin/ms07-003.mspx
  • Computer Terrorism (UK) :: Incident Response Centre - Microsoft Outlook Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051730.html
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (927198) http://www.microsoft.com/technet/security/bulletin/ms07-002.mspx
  Re-released for Excel2000 18 Jan 07.
  • iDefense Security Advisory 01.09.07: Microsoft Excel Invalid Column Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051695.html
  • iDefense Security Advisory 01.09.07: Microsoft Excel Long Palette Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051696.html
• Vulnerability in Microsoft Office 2003 Brazilian Portuguese Grammar Checker Could Allow Remote Code Execution (921585) http://www.microsoft.com/technet/security/bulletin/ms07-001.mspx
• Vulnerability in Windows Media Format Could Allow Remote Code Execution (923689) http://www.microsoft.com/technet/security/bulletin/ms06-078.mspx
• Vulnerability in Remote Installation Service Could Allow Remote Code Execution (926121) http://www.microsoft.com/technet/security/bulletin/ms06-077.mspx
• Cumulative Security Update for Outlook Express (923694) http://www.microsoft.com/technet/security/bulletin/ms06-076.mspx
• Vulnerability in Windows Could Allow Elevation of Privilege (926255) http://www.microsoft.com/technet/security/bulletin/ms06-075.mspx
• Vulnerability in SNMP Could Allow Remote Code Execution (926247) http://www.microsoft.com/technet/security/bulletin/ms06-074.mspx
• Vulnerability in Visual Studio 2005 Could Allow Remote Code Execution (925674) http://www.microsoft.com/technet/security/bulletin/ms06-073.mspx
  • Microsoft Security Advisory (927709) Vulnerability in Visual Studio 2005 Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/927709.mspx
  • Microsoft patches the WMI Object Broker bug http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050479.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050480.html
  • ZDI-06-047: Microsoft Visual Studio WmiScriptUtils.dll Cross-Zone Scripting Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051256.html
• Cumulative Security Update for Internet Explorer (925454) http://www.microsoft.com/technet/security/bulletin/ms06-072.mspx
  • ZDI-06-048: Microsoft Internet Explorer normalize() Function Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051257.html
  • Secunia Research: Internet Explorer Script Error Handling Memory Corruption http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051262.html
• (This is not an MS issue, but where to put it?)
  EEYE: Intel Network Adapter Driver Local Privilege Escalation http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051152.html
  Intel LAN Driver Buffer Overflow Local Privilege Escalation http://support.intel.com/support/network/sb/CS-023726.htm
• (This is not an MS issue, but where to put it?)
  Acer Notebooks ActiveX Control Arbitrary Command Execution https://www.sans.org/newsletters/risk/display.php?v=5&i=47#widely2
• (This is not an MS issue, but where to put it?)
  AusCERT Alert AL-2006.0106 -- NetGear WG111v2 Wireless Driver for Windows Long Beacon Overflow http://www.auscert.org.au/6992
  AusCERT Alert AL-2006.0108 -- NetGear MA521 Wireless Driver for Windows Long Rates Overflow http://www.auscert.org.au/7002
  See about disabling unused network interfaces, particularly wireless.
• Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (928088) http://www.microsoft.com/technet/security/bulletin/ms06-071.mspx
  • Microsoft Security Advisory (927892) Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/927892.mspx
• Vulnerability in Workstation Service Could Allow Remote Code Execution (924270) http://www.microsoft.com/technet/security/bulletin/ms06-070.mspx
  The bulletin says: On Windows XP Service Pack 2 the attack could only be successfully performed by a user with Administrator privileges but still WinXPSP2 is listed as affected: I am confused.
  • EEYE: Workstation Service NetpManageIPCConnect Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050716.html
• Vulnerabilities in Macromedia Flash Player from Adobe Could Allow Remote Code Execution (923789) http://www.microsoft.com/technet/security/bulletin/ms06-069.mspx
  • Microsoft Security Advisory (925143) Adobe Security Bulletin: APSB06-11 Flash Player Update to Address Security Vulnerabilities http://www.microsoft.com/technet/security/advisory/925143.mspx
  Superseded (same day!?), see:
  Update available for HTTP Header Injection Vulnerabilities in Adobe Flash Player http://www.adobe.com/support/security/bulletins/apsb06-18.html
• Vulnerability in Microsoft Agent Could Allow Remote Code Execution (920213) http://www.microsoft.com/technet/security/bulletin/ms06-068.mspx
  • COSEINC Alert: Microsoft Agent Heap Overflow Vulnerability Technical Details (Patched) http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052072.html
• Cumulative Security Update for Internet Explorer (922760) http://www.microsoft.com/technet/security/bulletin/ms06-067.mspx
  • Microsoft Security Advisory (925444) Vulnerability in the Microsoft DirectAnimation Path ActiveX Control Could Allow Remote Control Execution http://www.microsoft.com/technet/security/advisory/925444.mspx
  • [0day] daxctle2.c - Internet Explorer COM Object Heap Overflow Download Exec Exploit http://www.securityfocus.com/archive/1/445898
  • ZDI-06-040: WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050715.html
  • ZDI-06-041: Microsoft Internet Explorer CSS Float Property Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050717.html
• Vulnerabilities in Client Service for NetWare Could Allow Remote Code Execution (923980) http://www.microsoft.com/technet/security/bulletin/ms06-066.mspx
• (This is not an MS issue, but where to put it?)
  AusCERT Alert AL-2006.0103 -- Broadcom Wireless Driver Probe Response SSID Overflow http://www.auscert.org.au/6959
  and also D-Link DWL-G132 USB adapter.
  • Wireless fun! http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050675.html
  See about disabling unused network interfaces, particularly wireless.
• (This is not an MS issue, but where to put it?)
  AusCERT Advisory AA-2006.0085 -- Multiple laptops - Bluetooth stack vulnerability may allow remote compromise http://www.auscert.org.au/6893
• Microsoft Security Advisory (917021) Description of the Wi-Fi Protected Access 2 support for Wireless Group Policy in Windows XP Service Pack 2 http://www.microsoft.com/technet/security/advisory/917021.mspx
• Vulnerability In Windows Object Packager Could Allow Remote Code Execution (924496) http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx
  • Secunia Research: Microsoft Windows Object Packager Dialog Spoofing http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049986.html
• Vulnerabilities in TCP/IP Could Allow Denial of Service (922819) http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx
• Vulnerability in Server Service Could Allow Denial of Service (923414) http://www.microsoft.com/technet/security/bulletin/ms06-063.mspx
• Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (922581) http://www.microsoft.com/technet/security/bulletin/ms06-062.mspx
  • ZDI-06-034: Microsoft Office Word Malformed Chart Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049956.html
• Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (924191) http://www.microsoft.com/technet/security/bulletin/ms06-061.mspx
  Re-released 19 Oct 06.
• Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (924554) http://www.microsoft.com/technet/security/bulletin/ms06-060.mspx
  • Microsoft Security Advisory (925059) Vulnerability in Word Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/925059.mspx
  • Microsoft Word 0-day Vulnerability FAQ - September 2006, CVE-2006-4534 http://blogs.securiteam.com/?p=586
  • MS06-060 Microsoft Word Memmove Code Execution http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049996.html
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (924164) http://www.microsoft.com/technet/security/bulletin/ms06-059.mspx
  Re-released 12 Dec 06.
  • ZDI-06-033: Microsoft Office Excel File Format DATETIME Record Parsing Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049954.html
• Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (924163) http://www.microsoft.com/technet/security/bulletin/ms06-058.mspx
  • Microsoft Security Advisory (925984) Vulnerability in PowerPoint Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/925984.mspx
  • Microsoft PowerPoint Document Handling Client-Side Code Execution Vulnerability http://www.frsirt.com/english/advisories/2006/3794
  • ZDI-06-032: Microsoft Office PowerPoint Malformed Slide Notes Rebuilding Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049955.html
• Vulnerability in Windows Shell Could Allow Remote Code Execution (923191) http://www.microsoft.com/technet/security/bulletin/ms06-057.mspx
  • Microsoft Security Advisory (926043) Vulnerability in Windows Shell Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/926043.mspx
  • Exploit module available for WebViewFolderIcon setSlice 0-day http://www.securityfocus.com/archive/1/447174
• Vulnerability in ASP.NET Could Allow Information Disclosure (922770) http://www.microsoft.com/technet/security/bulletin/ms06-056.mspx
• Vulnerability in Vector Markup Language Could Allow Remote Code Execution (925486) http://www.microsoft.com/technet/security/bulletin/ms06-055.mspx
  • Microsoft Security Advisory (925568) Vulnerability in Vector Markup Language Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/925568.mspx
  • Sunbelt Software: New Microsoft Internet Explorer Expolit - 9-18-2006 http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049538.html
  • Internet Explorer VML Zero-Day Mitigation http://blogs.securiteam.com/?p=624
• Microsoft Security Advisory (922582) Update for Windows http://www.microsoft.com/technet/security/advisory/922582.mspx
• Vulnerability in Microsoft Publisher Could Allow Remote Code Execution (910729) http://www.microsoft.com/technet/security/bulletin/ms06-054.mspx
  • Computer Terrorism (UK) :: Incident Response Centre - Microsoft Publisher Font Parsing Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049423.html
• Vulnerability in Indexing Service Could Allow Cross-Site Scripting (920685) http://www.microsoft.com/technet/security/bulletin/ms06-053.mspx
  • Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053] http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049784.html
• (WXP) Vulnerability in Pragmatic General Multicast (PGM) Could Allow Remote Code Execution (919007) http://www.microsoft.com/technet/security/bulletin/ms06-051.mspx
• Vulnerability in Windows Kernel Could Result in Remote Code Execution (917422) http://www.microsoft.com/technet/security/bulletin/ms06-051.mspx
• Vulnerabilities in Microsoft Windows Hyperlink Object Library Could Allow Remote Code Execution (920670) http://www.microsoft.com/technet/security/bulletin/ms06-050.mspx
  • ***ULTRALAME*** Microsoft Excel Unicode Overflow ***ULTRALAME*** http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047005.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047041.html
  • http://blogs.technet.com/msrc/archive/2006/06/20/437826.aspx
  • AusCERT Alert AL-2006.0051 -- Microsoft Hyperlink Object Library stack buffer overflow http://www.auscert.org.au/6421
  • TSRT-06-10: Microsoft HLINK.DLL Hyperlink Object Library Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048591.html
• (W2k) Vulnerability in Windows Kernel Could Result in Elevation of Privilege (920958) http://www.microsoft.com/technet/security/bulletin/ms06-049.mspx
  Re-released 27 Sep 06.
  • FYI: MS06-049 patch (920958) corrupts NTFS compression files http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049369.html
• Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (922968) http://www.microsoft.com/technet/security/bulletin/ms06-048.mspx
  • Microsoft Security Advisory (922970) Vulnerability in PowerPoint Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/922970.mspx
  • AusCERT Advisory AA-2006.0046) -- Microsoft PowerPoint vulnerability allows execution of arbitrary code http://www.auscert.org.au/6483
  • Microsoft PowerPoint 0-day Vulnerability FAQ http://blogs.securiteam.com/?p=508
• Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (921645) http://www.microsoft.com/technet/security/bulletin/ms06-047.mspx
• Vulnerability in HTML Help Could Allow Remote Code Execution (922616) http://www.microsoft.com/technet/security/bulletin/ms06-046.mspx
• Vulnerability in Windows Explorer Could Allow Remote Code Execution (921398) http://www.microsoft.com/technet/security/bulletin/ms06-045.mspx
  • TSRT-06-08: Microsoft Internet Help COM Object Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048589.html
• (W2k) Vulnerability in Microsoft Management Console Could Allow Remote Code Execution (917008) http://www.microsoft.com/technet/security/bulletin/ms06-044.mspx
• Vulnerability in Microsoft Windows Could Allow Remote Code Execution (920214) http://www.microsoft.com/technet/security/bulletin/ms06-043.mspx
• Cumulative Security Update for Internet Explorer (918899) http://www.microsoft.com/technet/security/bulletin/ms06-042.mspx
  Updated 15 Aug 06 and again 24 Aug 06, yet again on 12 Sep 06, but as noted in http://blogs.msdn.com/ie/archive/2006/09/12/750815.aspx the problem http://support.microsoft.com/kb/923996/ is still not fixed.
  • ZDI-06-026: Microsoft Internet Explorer Multiple CSS Imports Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048586.html
  • ZDI-06-027: Microsoft Internet Explorer CSS Class Ordering Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048587.html
  • TSRT-06-09: Microsoft DirectAnimation COM Object Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048590.html
  • EEYE: Internet Explorer Compressed Content URL Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/049008.html
  • [EEYEB-20080824] Internet Explorer Compressed Content URL Heap Overflow Vulnerability #2 http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049428.html
• Vulnerability in DNS Resolution Could Allow Remote Code Execution (920683) http://www.microsoft.com/technet/security/bulletin/ms06-041.mspx
• Vulnerability in Server Service Could Allow Remote Code Execution (921883) http://www.microsoft.com/technet/security/bulletin/ms06-040.mspx
  Re-released 12 Sep 06 (for W2003 and WinXPx64 only).
• (This is not an MS issue, but where to put it?)
  AusCERT AL-2006.0063 -- Intel Centrino Wireless Driver Malformed Frame Remote Code Execution http://www.auscert.org.au/6577
  See about disabling unused network interfaces, particularly wireless.
• Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution (915384) http://www.microsoft.com/technet/security/bulletin/ms06-039.mspx
  See also: NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerability http://www.securityfocus.com/archive/1/439887
• Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (917284) http://www.microsoft.com/technet/security/bulletin/ms06-038.mspx
  See also: SYMSA-2006-007: Microsoft Office Malformed String Parsing Vulnerability http://www.securityfocus.com/archive/1/439697
• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (917285) http://www.microsoft.com/technet/security/bulletin/ms06-037.mspx
  • Microsoft Security Advisory (921365) Vulnerability in Excel Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/921365.mspx
    ZDI-06-022: Microsoft Office Excel File Rebuilding Code Execution Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047822.html
    Microsoft Excel Array Index Error Remote Code Execution http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047834.html
    Microsoft Excel Could Allow Remote Code Execution by Malformed FNGROUPCOUNT value Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047837.html
    NSFOCUS SA2006-05 : Microsoft Excel SELECTION Record Memory Corruption Vulnerability http://www.securityfocus.com/archive/1/439914
    NSFOCUS SA2006-06 : Microsoft Excel COLINFO Record Buffer Overflow Vulnerability http://www.securityfocus.com/archive/1/439909
  • Reports of a new vulnerability in Microsoft Excel http://blogs.technet.com/msrc/archive/2006/06/16/436174.aspx http://blogs.technet.com/msrc/archive/2006/06/17/436860.aspx
  • Reports of Excel 0-Day http://isc.sans.org/diary.php?storyid=1420 http://isc.sans.org/diary.php?storyid=1426
  • Microsoft Excel 0-day Vulnerability FAQ http://blogs.securiteam.com/?p=451
  • Secunia http://secunia.com/advisories/20686/ had this (before ms06-037) with a "green tick" for "Vendor Workaround", though that might work for Excel2003 only.
• Vulnerability in DHCP Client Service Could Allow Remote Code Execution (914388) http://www.microsoft.com/technet/security/bulletin/ms06-036.mspx
  See also: CYBSEC - Security Pre-Advisory: Microsoft Windows DHCP Client Service Remote Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047819.html
  CYBSEC - Security Advisory: Microsoft Windows DHCP Client Service Remote Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/049125.html
• Vulnerability in Server Service Could Allow Remote Code Execution (917159) http://www.microsoft.com/technet/security/bulletin/ms06-035.mspx
  Information About Public Postings Related to MS06-035 http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx
  AusCERT ESB-2006.0527 -- Vulnerability in Server Driver could result in Denial of Service http://www.auscert.org.au/6555
  This DoS is not fixed in Aug06 yet, see http://blogs.technet.com/msrc/archive/2006/08/09/445600.aspx
  See also: Microsoft SMB Information Disclosure Vulnerability CVE-2006-1315 http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047828.html
  TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability http://www.securityfocus.com/archive/1/439773
• Vulnerability in TCP/IP Could Allow Remote Code Execution (917953) http://www.microsoft.com/technet/security/bulletin/ms06-032.mspx
• (W2k) Vulnerability in RPC Mutual Authentication Could Allow Spoofing (917736) http://www.microsoft.com/technet/security/bulletin/ms06-031.mspx
• Vulnerability in Server Message Block Could Allow Elevation of Privilege (914389) http://www.microsoft.com/technet/security/bulletin/ms06-030.mspx
  See also: iDefense Security Advisory 06.13.06: Windows MRXSMB.SYS MrxSmbCscIoctlCloseForCopyChunk DoS http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046876.html
  iDefense Security Advisory 06.13.06: Windows MRXSMB.SYS MRxSmbCscIoctlOpenForCopyChunk Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046877.html
  [REVERSEMODE ADVISORY] MS06-030 - Microsoft Mrxsmb.sys privilege escalation advisory http://www.securityfocus.com/archive/1/437006
  [REVERSEMODE ADVISORY] MS06-030 NtClose DeadLock. http://www.securityfocus.com/archive/1/437016
  Regarding "SMB Invalid Handle Value" - MS06-030. Vulnerability not fixed. http://www.securityfocus.com/archive/1/437320
• Vulnerability in Microsoft PowerPoint Could Allow Remote Code Execution (916768) http://www.microsoft.com/technet/security/bulletin/ms06-028.mspx
• Vulnerability in Microsoft Word Could Allow Remote Code Execution (917336) http://www.microsoft.com/technet/security/bulletin/ms06-027.mspx
  • Microsoft Security Advisory (919637) Vulnerability in Word Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/919637.mspx
  • Microsoft fixes Word 0-day flaw - related to Smart Tags http://blogs.securiteam.com/index.php/archives/436
  • http://www.auscert.org.au/6316
  • http://www.kb.cert.org/vuls/id/446012
  • http://isc.sans.org/diary.php?storyid=1347 http://isc.sans.org/diary.php?storyid=1351
  • http://blogs.technet.com/msrc/archive/2006/05/19/429353.aspx
  • http://www.eeye.com/html/resources/newsletters/alert/pub/AL20060523.html
• (W98) Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (918547) http://www.microsoft.com/technet/security/bulletin/ms06-026.mspx
• Vulnerability in Routing and Remote Access Could Allow Remote Code Execution (911280) http://www.microsoft.com/technet/security/bulletin/ms06-025.mspx
  Update 18 Jun 06: This patch may affect dial-up networking, see http://support.microsoft.com/kb/911280
  Re-released 27 Jun 06.
• Vulnerability in Windows Media Player Could Allow Remote Code Execution (917734) http://www.microsoft.com/technet/security/bulletin/ms06-024.mspx
  See also: iDefense Security Advisory 06.13.06: Windows Media Player PNG Chunk Decoding Stack-Based Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046874.html
• Vulnerability in Microsoft JScript Could Allow Remote Code Execution (917344) http://www.microsoft.com/technet/security/bulletin/ms06-023.mspx
• Vulnerability in ART Image Rendering Could Allow Remote Code Execution (918439) http://www.microsoft.com/technet/security/bulletin/ms06-022.mspx
  See also: iDefense Security Advisory 06.13.06: Microsoft Internet Explorer ART File Heap Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046875.html
• Cumulative Security Update for Internet Explorer (916281) http://www.microsoft.com/technet/security/bulletin/ms06-021.mspx
  See also: ZDI-06-017: Microsoft Internet Explorer UTF-8 Decoding Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046880.html
  ZDI-06-018: Microsoft Internet Explorer DXImageTransform ActiveX Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046879.html
• (x64) Microsoft Security Advisory (914784) Update to Improve Kernel Patch Protection http://www.microsoft.com/technet/security/advisory/914784.mspx
• Vulnerabilities in Macromedia Flash Player from Adobe Could Allow Remote Code Execution (913433) http://www.microsoft.com/technet/security/bulletin/ms06-020.mspx
  See also (was released 9 Nov 05): Microsoft Security Advisory (910550) Macromedia Security Bulletin: MPSB05-07 Flash Player 7 Improper Memory Access Vulnerability http://www.microsoft.com/technet/security/advisory/910550.mspx
  See also (was released 14 Mar 06, not cross-referenced): Microsoft Security Advisory (916208) Adobe Security Bulletin: APSB06-03 Flash Player Update to Address Security Vulnerabilities http://www.microsoft.com/technet/security/advisory/916208.mspx
• Vulnerability in Microsoft Distributed Transaction Coordinator Could Allow Denial of Service (913580) http://www.microsoft.com/technet/security/bulletin/ms06-018.mspx
  See also: [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045921.html
  [EEYEB20051011B] - Microsoft Distributed Transaction Coordinator Denial of Service http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045920.html
  Microsoft MSDTC NdrAllocate Validation Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045952.html
• Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting (917627) http://www.microsoft.com/technet/security/bulletin/ms06-017.mspx
  See also: Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting http://www.securityfocus.com/archive/1/430803
• Cumulative Security Update for Outlook Express (911567) http://www.microsoft.com/technet/security/bulletin/ms06-016.mspx
  See also: ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045003.html
  See also: Recent Microsoft Patches Causing Problems (20 April 2006) http://www.sans.org/newsletters/newsbites/newsbites.php?vol=8&issue=32#306
• Vulnerability in Windows Explorer Could Allow Remote Code Execution (908531) http://www.microsoft.com/technet/security/bulletin/ms06-015.mspx
  Re-released 25 Apr 06.
  See also: Recent Microsoft Patches Causing Problems (20 April 2006) http://www.sans.org/newsletters/newsbites/newsbites.php?vol=8&issue=32#306
  You may experience problems in Windows Explorer or in the Windows shell after you install security update MS06-015 http://support.microsoft.com/kb/918165
• Vulnerability in the Microsoft Data Access Components (MDAC) Function Could Allow Code Execution (911562) http://www.microsoft.com/technet/security/bulletin/ms06-014.mspx
• Cumulative Security Update for Internet Explorer (912812) http://www.microsoft.com/technet/security/bulletin/ms06-013.mspx
  See also: Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045032.html
  [BuHa-Security] Multiple Vulnerabilities in MS IE 6.0 SP2 http://www.securityfocus.com/archive/1/430882
  See also: Microsoft Security Advisory (917077) Vulnerability in the way HTML Objects Handle Unexpected Method Calls Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/917077.mspx
  Microsoft Security Advisory (912945) Non-Security Update for Internet Explorer http://www.microsoft.com/technet/security/advisory/912945.mspx
  See also: Popup Blocker Bypass Script http://www.securityfocus.com/archive/1/428610
  See also: Recent Microsoft Patches Causing Problems (20 April 2006) http://www.sans.org/newsletters/newsbites/newsbites.php?vol=8&issue=32#306
• Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (905413) http://www.microsoft.com/technet/security/bulletin/ms06-012.mspx
  See also: Microsoft PowerPoint Vulnerability FAQ - August 2006, CVE-2006-4274 http://blogs.securiteam.com/?p=559
• Permissive Windows Services DACLs Could Allow Elevation of Privilege (914798) http://www.microsoft.com/technet/security/bulletin/ms06-011.mspx
  Re-released 13 Jun 06 (need to re-apply).
  See also: Microsoft Security Advisory (914457) Possible Vulnerability in Windows Service ACLs http://www.microsoft.com/technet/security/advisory/914457.mspx
• Vulnerability in PowerPoint 2000 Could Allow Information Disclosure (889167) http://www.microsoft.com/technet/security/bulletin/ms06-010.mspx
• Vulnerability in the Korean Input Method Editor Could Allow Elevation of Privilege (901190) http://www.microsoft.com/technet/security/bulletin/ms06-009.mspx
• Vulnerability in Web Client Service Could Allow Remote Code Execution (911927) http://www.microsoft.com/technet/security/bulletin/ms06-008.mspx
• Vulnerability in TCP/IP Could Allow Denial of Service (913446) http://www.microsoft.com/technet/security/bulletin/ms06-007.mspx
• Vulnerability in Windows Media Player Plug-in with Non-Microsoft Internet Browsers Could Allow Remote Code Execution (911564) http://www.microsoft.com/technet/security/bulletin/ms06-006.mspx
  See also: iDefense Security Advisory 02.14.06: Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042186.html
• Vulnerability in Windows Media Player Could Allow Remote Code Execution (911565) http://www.microsoft.com/technet/security/bulletin/ms06-005.mspx
  See also: After you apply some updates, you may experience some issues when you try to seek, to fast rewind, or to fast forward in Windows Media Player 10 http://support.microsoft.com/kb/912226
  [EEYEB-20051017] Windows Media Player BMP Heap Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042197.html
• Cumulative Security Update for Internet Explorer (910620) http://www.microsoft.com/technet/security/bulletin/ms06-004.mspx
  See also: Microsoft Security Advisory (913333) Vulnerability in Internet Explorer Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/913333.mspx
• Vulnerability in TNEF Decoding in Microsoft Outlook and Microsoft Exchange Could Allow Remote Code Execution (902412) http://www.microsoft.com/technet/security/bulletin/ms06-003.mspx
  See also: Microsoft Exchange Critical Vulnerability http://www.securityfocus.com/archive/1/421518
  Microsoft Outlook Critical Vulnerability http://www.securityfocus.com/archive/1/421520
• Vulnerability in Embedded Web Fonts Could Allow Remote Code Execution (908519) http://www.microsoft.com/technet/security/bulletin/ms06-002.mspx
  See also: [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041249.html http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041250.html
• Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919) http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx
  See also: Microsoft Security Advisory (912840) Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/912840.mspx
  Is this a new exploit? http://www.securityfocus.com/archive/1/420288
  Someone wasted a nice bug on spyware... http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040668.html http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040699.html
  AUSCERT ALERT AL-2005.0043 -- Unpatched flaw in WMF image file handling exploited in wild http://www.auscert.org.au/5872
  AusCERT Update AU-2005.0023 -- Partial workarounds available for WMF file handling vulnerability http://www.auscert.org.au/5873
  WMF Exploit http://www.securityfocus.com/archive/1/420378 http://www.securityfocus.com/archive/1/420379 http://www.securityfocus.com/archive/1/420660 http://www.securityfocus.com/archive/1/420769
  Exploiting WMF (tiny) FAQ http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041044.html
• (W2k) Vulnerability in Windows Kernel Could Allow Elevation of Privilege (908523) http://www.microsoft.com/technet/security/bulletin/ms05-055.mspx
  See also: [EEYEB-20050523] Windows Kernel APC Data-Free Local Privilege Escalation Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039896.html
• Cumulative Security Update for Internet Explorer (905915) http://www.microsoft.com/technet/security/bulletin/ms05-054.mspx
  See also: Microsoft Security Advisory (911302) Vulnerability in the way Internet Explorer Handles Mismatched Document Object Model Objects Could Allow Remote Code Execution (was ... Handles onLoad Events ...) http://www.microsoft.com/technet/security/advisory/911302.mspx
  Malicious Software Encyclopedia: TrojanDownloader:Win32/Delf.DH http://www.microsoft.com/security/encyclopedia/details.aspx?name=TrojanDownloader:Win32/Delf.DH
  Secunia Research: Microsoft Internet Explorer Keyboard Shortcut Processing Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039907.html
  Secunia Research: Internet Explorer Suppressed "Download Dialog" Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039908.html
  See also: Microsoft Internet Explorer does not honor ActiveX kill bit http://www.kb.cert.org/vuls/id/998297
• Microsoft Security Advisory (911052) Memory Allocation Denial of Service Via RPC http://www.microsoft.com/technet/security/advisory/911052.mspx
• Vulnerabilities in Graphics Rendering Engine Could Allow Code Execution (896424) http://www.microsoft.com/technet/security/bulletin/ms05-053.mspx
  See also: [EEYEB-20050901] Windows Metafile SetPalette Entries Heap OVerflow Vulnerability (Graphics Rendering Engine Vulnerability) http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038491.html
  [EEYEB-20050329] Windows Metafile Multiple Heap Overflows http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038492.html
• Cumulative Security Update for Internet Explorer (896688) http://www.microsoft.com/technet/security/bulletin/ms05-052.mspx
  (I wonder why http://support.microsoft.com/kb/870669 was not promoted more vigorously ...)
  See also: [EEYEB20050915] - MDT2DD.DLL COM Object Uninitialized Heap Memory Vulnerability http://www.securityfocus.com/archive/1/413000
• Vulnerabilities in MSDTC and COM+ Could Allow Remote Code Execution (902400) http://www.microsoft.com/technet/security/bulletin/ms05-051.mspx
  See also: Microsoft Security Advisory (909444) Various Issues After Installing Microsoft Security Bulletin MS05-051 on Systems That Have Non-default File Permissions http://www.microsoft.com/technet/security/advisory/909444.mspx
  iDEFENSE Security Advisory 10.11.05: Microsoft Distributed Transaction Controller Packet Relay DoS Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/037908.html
  iDEFENSE Security Advisory 10.11.05: Microsoft Distributed Transaction Controller TIP DoS Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/037909.html
  [EEYEB20050708] Microsoft Distributed Transaction Coordinator Memory Modification Vulnerability http://www.securityfocus.com/archive/1/413001
• Vulnerability in DirectShow Could Allow Remote Code Execution (904706) http://www.microsoft.com/technet/security/bulletin/ms05-050.mspx
  See also: The computer may not be updated after you install the "Security Update for DirectX 7.0 for Windows 2000 (KB904706)" on a Windows 2000-based computer that is running DirectX 8 or DirectX 9 http://support.microsoft.com/kb/909596
  [EEYEB20050510] - Microsoft DirectShow Remote Code Vulnerability http://www.securityfocus.com/archive/1/413002
• Vulnerabilities in Windows Shell Could Allow Remote Code Execution (900725) http://www.microsoft.com/technet/security/bulletin/ms05-049.mspx
  See also: [Argeniss] Story of a dumb patch (Paper advisory about CSRSS and Windows Explorer vulnerabilities) http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038045.html
• Vulnerability in the Microsoft Collaboration Data Objects Could Allow Remote Code Execution (907245) http://www.microsoft.com/technet/security/bulletin/ms05-048.mspx
  See also: [SEC-1 Advisory] Collaboration Data Objects Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/037919.html
• Vulnerability in Plug and Play Could Allow Remote Code Execution and Local Elevation of Privilege (905749) http://www.microsoft.com/technet/security/bulletin/ms05-047.mspx
  See also: [EEYEB20050803] - Windows UMPNPMGR wsprintfW Stack Buffer Overflow Vulnerability http://www.securityfocus.com/archive/1/412999
• Vulnerability in the Client Service for NetWare Could Allow Remote Code Execution (899589) http://www.microsoft.com/technet/security/bulletin/ms05-046.mspx
• Vulnerability in Network Connection Manager Could Allow Denial of Service (905414) http://www.microsoft.com/technet/security/bulletin/ms05-045.mspx
• Vulnerability in the Windows FTP Client Could Allow File Transfer Location Tampering (905495) http://www.microsoft.com/technet/security/bulletin/ms05-044.mspx
• AUSCERT Advisory AA-2005.0014 -- Microsoft Releases Service Packs for Office, Project and Visio http://www.auscert.org.au/5543
  See also: http://support.microsoft.com/kb/887616 http://support.microsoft.com/kb/887620 http://support.microsoft.com/kb/887622
• Microsoft Security Advisory (897663) Windows Firewall Exception May Not Display in the User Interface http://www.microsoft.com/technet/security/advisory/897663.mspx
• Vulnerability in Print Spooler Service Could Allow Remote Code Execution (896423) http://www.microsoft.com/technet/security/bulletin/ms05-043.mspx
• Vulnerabilities in Kerberos Could Allow Denial of Service, Information Disclosure, and Spoofing (899587) http://www.microsoft.com/technet/security/bulletin/ms05-042.mspx
• Vulnerability in Remote Desktop Protocol Could Allow Denial of Service (899591) http://www.microsoft.com/technet/security/bulletin/ms05-041.mspx
• Vulnerability in Telephony Service Could Allow Remote Code Execution (893756) http://www.microsoft.com/technet/security/bulletin/ms05-040.mspx
• Vulnerability in Plug and Play Could Allow Remote Code Execution and Elevation of Privilege (899588) http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx
  See also: (Zotob worm) Microsoft Security Advisory (899588) Vulnerability in Plug and Play Could Allow Remote Code Execution and Elevation of Privilege http://www.microsoft.com/technet/security/advisory/899588.mspx
  Microsoft Security Advisory (906574) Clarification of Simple File Sharing and ForceGuest http://www.microsoft.com/technet/security/advisory/906574.mspx
• Cumulative Security Update for Internet Explorer (896727) http://www.microsoft.com/technet/security/bulletin/ms05-038.mspx
  Re-released 10 Aug 05.
  See also: NSFOCUS SA2005-02 : Microsoft IE Devenum.dll COM Instantiation Remote Code Execution Vulnerability http://www.securityfocus.com/archive/1/407777
  Microsoft Security Advisory (906267) A COM Object (Msdds.dll) Could Cause Internet Explorer to Unexpectedly Exit http://www.microsoft.com/technet/security/advisory/906267.mspx
  Microsoft Internet Explorer allows non-ActiveX COM objects to be instantiated http://www.kb.cert.org/vuls/id/680526
• An update that addresses Outlook Express 6.0 issues is available for Windows XP http://support.microsoft.com/kb/900930
  Is this related to http://www.securityfocus.com/bid/4092 http://archives.neohapsis.com/archives/bugtraq/2002-02/0124.html ?
• Vulnerability in JView Profiler Could Allow Remote Code Execution (903235) http://www.microsoft.com/technet/security/bulletin/ms05-037.mspx
• Vulnerability in Microsoft Color Management Module Could Allow Remote Code Execution (901214) http://www.microsoft.com/technet/security/bulletin/ms05-036.mspx
• Vulnerability in Microsoft Word Could Allow Remote Code Execution (903672) http://www.microsoft.com/technet/security/bulletin/ms05-035.mspx
  See also: iDEFENSE Security Advisory 07.12.05: Microsoft Word 2000 and Word 2002 Font Parsing Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-July/035044.html
• Update Rollup 1 for Windows 2000 SP4 http://support.microsoft.com/kb/891861
  See also: NULL sessions vulnerabilities using alternate named pipes http://lists.grok.org.uk/pipermail/full-disclosure/2005-July/034959.html
• Vulnerability in Telnet Client Could Allow Information Disclosure (896428) http://www.microsoft.com/technet/security/bulletin/ms05-033.mspx
  Re-released 12 Jul 05.
  See also: iDEFENSE Security Advisory 06.14.05: Multiple Vendor Telnet Client Information Disclosure Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034558.html
• Vulnerability in Microsoft Agent Could Allow Spoofing (890046) http://www.microsoft.com/technet/security/bulletin/ms05-032.mspx
  See also: What A Click! [Internet Explorer] http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041714.html
• Vulnerability in Step-by-Step Interactive Training Could Allow Remote Code Execution (898458) http://www.microsoft.com/technet/security/bulletin/ms05-031.mspx
  See also: iDEFENSE Security Advisory 06.14.05: Microsoft Windows Interactive Training Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034561.html
• Cumulative Security Update in Outlook Express (897715) http://www.microsoft.com/technet/security/bulletin/ms05-030.mspx
  See also: iDEFENSE Security Advisory 06.14.05: Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034559.html
  Update 9 Aug 05: ms05-030 is in fact NOT cumulative (was renamed Vulnerability in Outlook Express Could Allow Remote Code Execution (897715)) and does NOT include ms04-018.
• [WinXP SP1 only?] Vulnerability in Web Client Service Could Allow Remote Code Execution (896426) http://www.microsoft.com/technet/security/bulletin/ms05-028.mspx
• Vulnerability in Server Message Block Could Allow Remote Code Execution (896422) http://www.microsoft.com/technet/security/bulletin/ms05-027.mspx
• Vulnerability in HTML Help Could Allow Remote Code Execution (896358) http://www.microsoft.com/technet/security/bulletin/ms05-026.mspx
  See also: High Risk Vulnerability in HTML Help (ITSS Parser) http://www.securityfocus.com/archive/1/402309
  eEye Advisory - EEYEB-20050316 - HTML Help File Parsing Buffer Overflow http://www.securityfocus.com/archive/1/402350
• Cumulative Security Update for Internet Explorer (883939) http://www.microsoft.com/technet/security/bulletin/ms05-025.mspx
• Updates for Windows Media Player 9 Series and for Windows Media Player 10 http://support.micorsoft.com/kb/892313
• (W2k) Vulnerability in Web View Could Allow Remote Code Execution (894320) http://www.microsoft.com/technet/security/bulletin/ms05-024.mspx
  See also: File Selection May Lead to Command Execution (GM#015-IE) http://www.securityfocus.com/archive/1/396224
• Vulnerabilities in Microsoft Word May Lead to Remote Code Execution (890169) http://www.microsoft.com/technet/security/bulletin/ms05-023.mspx
  Re-released 14 Jun 05, or maybe not:
  MajorRev: v2.0 Microsoft Security Bulletin MS05-023 - Vulnerabilities in Microsoft Word May Lead to Remote Code Execution (890169) http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0095.html
• Vulnerability in MSN Messenger Could Lead to Remote Code Execution (896597) http://www.microsoft.com/technet/security/bulletin/ms05-022.mspx
• Cumulative Security Update for Internet Explorer (890923) http://www.microsoft.com/technet/security/bulletin/ms05-020.mspx
  See also: iDEFENSE Security Advisory 04.12.05: Microsoft Internet Explorer DHTML Engine Race Condition Vulnerability http://www.securityfocus.com/archive/1/395562
  iDEFENSE Security Advisory 04.12.05: Microsoft Windows Internet Explorer Long Hostname Heap Corruption Vulnerability http://www.securityfocus.com/archive/1/395559
  Internet Explorer wininet.dll URL parsing memory corruption technical details http://lists.grok.org.uk/pipermail/full-disclosure/2005-April/033373.html
• Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service (893066) http://www.microsoft.com/technet/security/bulletin/ms05-019.mspx
  Re-released 14 Jun 05: re-install.
  See also: MS05-019 breaks TCP raw socket sends http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0040.html
  MS05-019 Breaks VPN http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0049.html http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0053.html http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0057.html Bug in Patch MS05-019 http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0052.html
  Raw sockets, MS05-019 and Windows Firewall -- Summary http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0058.html
• Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege and Denial of Service (890859) http://www.microsoft.com/technet/security/bulletin/ms05-018.mspx
  See also: iDEFENSE Security Advisory 04.12.05: Microsoft Windows CSRSS.EXE Stack Overflow Vulnerability http://www.securityfocus.com/archive/1/395560
  Windows kernel overflow fixed http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0044.html
  autorun problems after installing latest MS patches ms05-016 to -022 on Win2k server http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0041.html http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0043.html
• Vulnerability in Message Queuing Could Allow Code Execution (892944) http://www.microsoft.com/technet/security/bulletin/ms05-017.mspx
• Vulnerability in Windows Shell that Could Allow Remote Code Execution (893086) http://www.microsoft.com/technet/security/bulletin/ms05-016.mspx
  See also: iDEFENSE Security Advisory 04.12.05: Microsoft MSHTA Script Execution Vulnerability http://www.securityfocus.com/archive/1/395563
• Vulnerability in Hyperlink Object Library Could Allow Remote Code Execution (888113) http://www.microsoft.com/technet/security/bulletin/ms05-015.mspx
• Cumulative Security Update for Internet Explorer (867282) http://www.microsoft.com/technet/security/bulletin/ms05-014.mspx
  See also: Internet Explorer zone spoofing with encoded URLs http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031545.html
• Vulnerability in the DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (891781) http://www.microsoft.com/technet/security/bulletin/ms05-013.mspx
• Vulnerability in OLE and COM Could Allow Remote Code Execution (873333) http://www.microsoft.com/technet/security/bulletin/ms05-012.mspx
• Vulnerability in Server Message Block Could Allow Remote Code Execution (885250) http://www.microsoft.com/technet/security/bulletin/ms05-011.mspx
  See also: GREENAPPLE Release http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031528.html
  EEYE: Windows SMB Client Transaction Response Handling Vulnerability http://www.securityfocus.com/archive/1/389813 http://www.securityfocus.com/archive/1/392768
• Vulnerability in PNG Processing Could Allow Remote Code Execution (890261) http://www.microsoft.com/technet/security/bulletin/ms05-009.mspx
  See also: CORE-2004-0819: MSN Messenger PNG Image Parsing Vulnerability http://www.securityfocus.com/archive/1/389801
• Vulnerability in Windows Shell Could Allow Remote Code Execution (890047) http://www.microsoft.com/technet/security/bulletin/ms05-008.mspx
• Vulnerability in Windows Could Allow Information Disclosure (888302) http://www.microsoft.com/technet/security/bulletin/ms05-007.mspx
  See also: Some details about MS05-007 security bulletin http://www.securityfocus.com/archive/1/389935
• Vulnerability in Microsoft Office XP could allow Remote Code Execution (873352) http://www.microsoft.com/technet/security/bulletin/ms05-005.mspx
  See also: Finjan Security Advisory: Microsoft Office XP Remote Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031534.html
• Vulnerability in the Indexing Service Could Allow Remote Code Execution (871250) http://www.microsoft.com/technet/security/bulletin/ms05-003.mspx
• Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution (891711) http://www.microsoft.com/technet/security/bulletin/ms05-002.mspx
  See also: EEYE: Windows ANI File Parsing Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030780.html
  Updated W98 patches released 12 Apr 05.
• Vulnerability in HTML Help Could Allow Code Execution (890175) http://www.microsoft.com/technet/security/bulletin/ms05-001.mspx
  See also: Internet Explorer HTML Help Control ActiveX Cross Domain/Zone Scripting Vulnerabilities http://www.securityfocus.com/archive/1/380096
  Microsoft Help ActiveX Control Related Topics Local Content Accessing Vulnerability http://www.securityfocus.com/archive/1/382513
  Internet Explorer Help ActiveX Control Local Zone Security Restriction Bypass Vulnerability (updated) http://www.securityfocus.com/archive/1/384937
  YEY AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2 http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030268.html
• (WXPSP2) Windows Firewall update available http://archives.neohapsis.com/archives/ntbugtraq/2004-q4/0149.html
  See also http://support.microsoft.com/kb/886185
• Vulnerabilities in Windows Kernel and LSASS Could Allow Elevation of Privilege (885835) http://www.microsoft.com/technet/security/bulletin/ms04-044.mspx
  See also http://support.microsoft.com/kb/885835
  [AppSecInc Team SHATTER Security Advisory] Microsoft Windows Improper Token Validation http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030725.html
  [AppSecInc Team SHATTER Security Advisory] Microsoft Windows LPC heap overflow http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030726.html
• Vulnerability in HyperTerminal Could Allow Code Execution (873339) http://www.microsoft.com/technet/security/bulletin/ms04-043.mspx
  See also: HyperTerminal - Buffer Overflow In .ht File http://archives.neohapsis.com/archives/ntbugtraq/2004-q4/0150.html
• Vulnerability in WordPad Could Allow Code Execution (885836) http://www.microsoft.com/technet/security/bulletin/ms04-041.mspx
  See also: iDEFENSE Security Advisory 12.14.04 - Microsoft Word 6.0/95 Document Converter Buffer Overflow Vulnerability http://www.securityfocus.com/archive/1/384418
• Cumulative Security Update for Internet Explorer (889293) http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
  Out-of-monthly-cycle patch for IFRAME vulnerability?
  See also (or use instead?) http://support.microsoft.com/kb/889669
• Cumulative Security Update for Internet Explorer (834707) http://www.microsoft.com/technet/security/bulletin/ms04-038.mspx
  See also: ACROS Security: Poisoning Cached HTTPS Documents in Internet Explorer http://archives.neohapsis.com/archives/ntbugtraq/2004-q4/0062.html
  MSN Gaming Heartbeat Component Buffer Overflow http://www.securityfocus.com/archive/1/378324
  MSN Heartbeat Control Buffer Overflow http://www.securityfocus.com/archive/1/387726
  Address Bar Spoofing on Double Byte Character Set Locale Vulnerability (CAN-2004-0844) Patched in MS04-038 http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029552.html
  Microsoft Internet Explorer Install Engine Control Buffer Overflow (#NISR19012005a) http://www.securityfocus.com/archive/1/387727
• Vulnerability in Windows Shell Could Allow Remote Code Execution (841356) http://www.microsoft.com/technet/security/bulletin/ms04-037.mspx
• (WXP, W2k3) Vulnerability in Compressed (zipped) Folders Could Allow Remote Code Execution (873376) http://www.microsoft.com/technet/security/bulletin/ms04-034.mspx
  See also: EEYE: Windows Shell ZIP File Decompression DUNZIP32.DLL Buffer Overflow Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027449.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027472.html
• Vulnerability in Microsoft Excel Could Allow Remote Code Execution (886836) http://www.microsoft.com/technet/security/bulletin/ms04-033.mspx
  See also: Buffer Overflow In Microsoft Excel http://archives.neohapsis.com/archives/ntbugtraq/2004-q4/0065.html
• Security Update for Microsoft Windows (840987) http://www.microsoft.com/technet/security/bulletin/ms04-032.mspx
  See also: EEYE: Windows VDM #UD Local Privilege Escalation http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027448.html
  SetWindowLong Shatter Attacks http://archives.neohapsis.com/archives/ntbugtraq/2004-q4/0066.html
• Vulnerability in NetDDE Could Allow Remote Code Execution (841533) http://www.microsoft.com/technet/security/bulletin/ms04-031.mspx
  See also: Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow http://www.securityfocus.com/archive/1/387994
• (WNT) Vulnerability in RPC Runtime Library Could Allow Information Disclosure and Denial of Service (873350) http://www.microsoft.com/technet/security/bulletin/ms04-029.mspx
  See also: BindView Advisory: Memory Leak and DoS in NT4 RPC server http://www.securityfocus.com/archive/1/378277
• Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx
  Updated 12 Oct 04 with correct installers for WinXP.
  See also: Re: Alert: Microsoft Security Bulletin MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0186.html
  (GDI+) detection tool don't run without admin prevs. http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0190.html
  SANS GDIscan http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026921.html
  Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026454.html
  JPEG Processing BOF Proof Of Concept http://www.securityfocus.com/archive/1/375431 http://www.securityfocus.com/archive/1/375536
• Vulnerability in WordPerfect Converter Could Allow Code Execution (884933) http://www.microsoft.com/technet/security/bulletin/ms04-027.mspx
  See also: Re: Alert: Microsoft Security Bulletin MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0189.html
  Microsoft WordPerfect 5.x Converter Heap Overflow http://www.securityfocus.com/archive/1/375436
• WinXP users should install the SP2 update.
  See the notes and FAQ on how to block automatic delivery via WU and AU.
  See "EULA tidbits" in http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0094.html
  SP2 and Sysprep http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0112.html
  Flaws security feature of SP2 http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025349.html
  Flaws in the new security functions of SP2 - revisited http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026073.html
  Flaws in SP2 security features, part II http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028882.html
  Warning: SP2 doesn't deploy silently with SUS http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0123.html http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0132.html
  Microsoft Windows XP SP2 http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025513.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025521.html
  WinXP SP2 hacks dial-up Internet users wide open? http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026544.html
  Writing Trojans that bypass Windows XP Service Pack 2 Firewall http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027389.html
  Hardware support for XP SP2 DEP not enabled by default ? http://www.securityfocus.com/archive/1/382002
  HOW TO BREAK XP SP2 POPUP BLOCKER: kick it in the nut ! http://www.securityfocus.com/archive/1/384037
• Cumulative Security Update for Internet Explorer (867801) http://www.microsoft.com/technet/security/bulletin/ms04-025.mspx
  No Win98 patch yet.
  See also: An update rollup is available ... http://support.microsoft.com/kb/871260
• Vulnerability in Windows Shell Could Allow Remote Code Execution (839645) http://www.microsoft.com/technet/security/bulletin/ms04-024.mspx
  See also: After you install Security Update 839645, you may experience sharing violations and increased network traffic under Windows XP http://support.microsoft.com/kb/871242
• Vulnerability in HTML Help Could Allow Code Execution (840315) http://www.microsoft.com/technet/security/bulletin/ms04-023.mspx
  See also: HtmlHelp - .CHM File Heap Overflow http://www.securityfocus.com/archive/1/368856
• Vulnerability in Task Scheduler Could Allow Code Execution (841873) http://www.microsoft.com/technet/security/bulletin/ms04-022.mspx
  See also: Microsoft Windows Task Scheduler '.job' Stack Overflow http://www.securityfocus.com/archive/1/368858
  Unchecked buffer in mstask.dll http://www.securityfocus.com/archive/1/368857 http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023948.html
  Hmm... should we drop all IconHandler from the registry? On Win2k, I copied cmd.exe (from winnt\system32) as xyz.pif; then (right-click) Properties, Program crashes explorer. Is this related to IconHandler, and is it exploitable?
• Vulnerability in POSIX Could Allow Code Execution (841872) http://www.microsoft.com/technet/security/bulletin/ms04-020.mspx
• Vulnerability in Utility Manager Could Allow Code Execution (842526) http://www.microsoft.com/technet/security/bulletin/ms04-019.mspx
  See also: Microsoft Window Utility Manager Local Elevation of Privileges http://www.securityfocus.com/archive/1/368793
• Cumulative Security Update for Outlook Express (823353) http://www.microsoft.com/technet/security/bulletin/ms04-018.mspx
• Critical Update for Microsoft Data Access Components - Disable ADODB.Stream object from Internet Explorer (KB870669)
  See:
  How to disable the ADODB.Stream object from Internet Explorer http://support.microsoft.com/kb/870669
  Microsoft Statement Regarding Configuration Change to Windows in Response to Download.Ject Security Issue http://www.microsoft.com/presspass/press/2004/jul04/07-02configchange.asp
  This "fix" is useless as it can be circumvented and/or un-done, see:
  Fix for IE ADODB.Stream vulnerability is out http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023392.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023397.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023400.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023403.html
  Maybe(?) use sensible protection instead, see:
  Registry Fix For Variant of Scob http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023443.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023534.html
• Vulnerability in Crystal Reports Web Viewer could allow Information Disclosure and Denial of Service (842689) http://www.microsoft.com/technet/security/bulletin/ms04-017.mspx
• Vulnerability in DirectPlay Could Allow Denial of Service (839643) http://www.microsoft.com/technet/security/bulletin/ms04-016.mspx
• (WXP,W2k3) Vulnerability in Help and Support Center Could Allow Remote Code Execution (840374) http://www.microsoft.com/technet/security/bulletin/ms04-015.mspx
  See also: MS04-015 - Windows Help Center - Dvdupgrade http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021221.html
  Bug in XP Help and Support, or Don't Be Fooled By Disabled Services http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022422.html
• Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001) http://www.microsoft.com/technet/security/bulletin/ms04-014.mspx
  Problems caused by patch (awaiting fix):
  Ms Patch 837001 - problems? http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020204.html
  After Ms patches last Wed ... http://www.securityfocus.com/archive/1/360462 http://www.securityfocus.com/archive/1/360648 http://www.securityfocus.com/archive/1/360633
• Cumulative Security Update for Outlook Express (837009) http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx
  Note that you need this even if Outlook Express is not used as the default e-mail reader.
  See also: AU-2004.007 -- AusCERT Update - Vulnerability in Internet Explorer Allows Program Execution http://www.auscert.org.au/3990
  Microsoft Internet Explorer does not properly validate source of CHM components referenced by ITS protocol handlers http://www.kb.cert.org/vuls/id/323070
  US-CERT Technical Cyber Security Alert TA04-099A -- Vulnerability in Internet Explorer ITS Protocol Handler http://www.us-cert.gov/cas/techalerts/TA04-099A.html
  MHTML Redirection Leads to Downloading EXE and Executing http://www.securityfocus.com/archive/1/345615
  IE 5.x-6.0 allows executing arbitrary programs using showHelp() http://www.securityfocus.com/archive/1/348521
  Microsoft Internet Explorer Unspecified CHM File Processing Arbitrary Code Execution Vulnerability (bid 9658) http://www.securityfocus.com/archive/1/354447
  New worm? http://www.securityfocus.com/archive/1/358862
• Cumulative Update for Microsoft RPC/DCOM (828741) http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx
  See also: EEYE: Microsoft DCOM RPC Race Condition http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020067.html
  EEYE: Microsoft DCOM RPC Memory Leak http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020071.html
  Problems caused by patch (awaiting fix):
  MS04-012 breaks AT command when managing NT 4.0 scheduler from XP PC http://archives.neohapsis.com/archives/ntbugtraq/2004-q2/0027.html
• Security Update for Microsoft Windows (835732) http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
  LSASS workaround create file %systemroot%\debug\dcpromo.log and make it read-only added 4 May 04. Is that sufficient to protect against Sasser?
  See also: Microsoft Help and Support Center argument injection vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020065.html iDEFENSE Security Advisory 04.13.04 - Microsoft Help and Support Center Argument Injection Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020063.html
  EEYE: Windows Expand-Down Data Segment Local Privilege Escalation http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020068.html
  EEYE: Windows Local Security Authority Service Remote Buffer Overflow http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020069.html
  EEYE: Windows VDM TIB Local Privilege Escalation http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020070.html
  NSFOCUS SA2004-01 : DoS Vulnerability in Microsoft Windows SPNEGO Protocol Decoding http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020080.html
  Utility Manager - Failure to drop system privileges http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020137.html
  [SHATTER Team Security Alert] Microsoft Windows Utility Manager Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020179.html
  Potential Microsoft PCT worm (MS04-011) http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020473.html
  New Worm??? - High level of activity on port 445 http://www.securityfocus.com/archive/1/361756
  A technical description of the SSL PCT vulnerability (CVE-2003-0719) http://www.securityfocus.com/archive/1/361836
  SSL PCT vulnerability information http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020784.html
  Sasser Worm Analysis - LURHQ http://www.lurhq.com/sasser.html
  Problems caused by patch (awaiting fix):
  http://support.microsoft.com/kb/835732
  I have a report that a "CPU at 99%" problem may be solved by setting CacheLimit to 1024 (hex 400) in (both?) [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Content]
  MS04-011 Break SSL support in IE 6.0.3790.0 with Windows 2003 http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020246.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020265.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020269.html
• Vulnerability in MSN Messenger Could Allow Information Disclosure (838512) http://www.microsoft.com/technet/security/bulletin/ms04-010.mspx
• Vulnerability in Microsoft Outlook Could Allow Code Execution (828040) http://www.microsoft.com/technet/security/bulletin/ms04-009.mspx
  Update 10 Mar 04: workaround was bogus, severity upped to critical.
  The patch also seems to be contained in Office XP Service Pack 3 http://support.microsoft.com/kb/832671
  See also: iDEFENSE Security Advisory 03.09.04: Microsoft Outlook "mailto:" Parameter Passing Vulnerability http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018452.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018594.html
  Outlook mailto: URL argument injection vulnerability http://www.securityfocus.com/archive/1/356901
• (W2k) Vulnerability in Windows Media Services Could Allow a Denial of Service (832359) http://www.microsoft.com/technet/security/bulletin/ms04-008.mspx
• ASN.1 Vulnerability Could Allow Code Execution (828028) http://www.microsoft.com/technet/security/bulletin/ms04-007.mspx
  See also:
  EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption http://www.securityfocus.com/archive/1/353320
  EEYE: Microsoft ASN.1 Library Bit String Heap Corruption http://www.securityfocus.com/archive/1/353323
  Note Win98 is also vulnerable: http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017479.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017515.html
• Vulnerability in the Windows Internet Naming Service (WINS) Could Allow Code Execution (830352) http://www.microsoft.com/technet/security/bulletin/ms04-006.mspx
• Cumulative Security Update for Internet Explorer (832894) http://www.microsoft.com/technet/security/bulletin/ms04-004.mspx
  Update 12 Feb 04: IE6SP1 needs also http://support.microsoft.com/kb/831167.
  See also: http://support.microsoft.com/kb/834489 http://archives.neohapsis.com/archives/ntbugtraq/2004-q1/0075.html
  Sandblad #12: Inject javascript url in history list (revisited) http://www.securityfocus.com/archive/1/352460
  MS to stop allowing passwords in URLs http://www.securityfocus.com/archive/1/352469
  ASPR #2004-01-20-1: Internet Explorer/Outlook double null character DoS http://www.securityfocus.com/archive/1/353285
• Buffer Overrun in MDAC Function Could Allow Code Execution (832483) http://www.microsoft.com/technet/security/bulletin/ms04-003.mspx
  See also: Microsoft Security Bulletin MS04-003 - perceived problems http://archives.neohapsis.com/archives/ntbugtraq/2004-q1/0016.html
  MDAC Patch Installation Mystery http://archives.neohapsis.com/archives/ntbugtraq/2004-q1/0018.html
• Buffer Overrun in Microsoft FrontPage Server Extensions Could Allow Code Execution (813360) http://www.microsoft.com/technet/security/bulletin/ms03-051.mspx
  Re-released 10 Feb 04 saying Office2000 is also affected.
  Microsoft Security Bulletin MS03-043/049 W2K anomollies http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0189.html
  Microsoft Security Bulletin MS03-049 - Installation problems? http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0191.html
  See also: Frontpage Extensions Remote Command Execution http://www.securityfocus.com/archive/1/344221 http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/013736.html
• Vulnerability in Microsoft Word and Microsoft Excel Could Allow Arbitrary Code to Run (831527) http://www.microsoft.com/technet/security/bulletin/ms03-050.mspx
• Buffer Overrun in the Workstation Service Could Allow Code Execution (828749) http://www.microsoft.com/technet/security/bulletin/ms03-049.mspx
  See also: Microsoft Security Bulletin MS03-049 - Installation problems? http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0180.html http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0183.html http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0200.html
  EEYE: Windows Workstation Service Remote Buffer Overflow http://www.securityfocus.com/archive/1/344137
  [CORE-2003-12-05] DCE RPC Vulnerabilities New Attack Vectors Analysis http://www.securityfocus.com/archive/1/347193 (noting that this affects ms03-043 ms03-039 ms03-026 ms03-001 also)
• Cumulative Security Update for Internet Explorer (824145) http://www.microsoft.com/technet/security/bulletin/ms03-048.mspx
  See also: Bugs, Old File Dates in New Microsoft Patches http://www.eweek.com/print_article/0,3048,a=112332,00.asp
• Certificate Validation Flaw Could Enable Identity Spoofing (Q328145) http://www.microsoft.com/technet/security/bulletin/ms02-050.mspx
  Re-released with new content, and new KB number Q329115, 20 Nov 02.
  Re-released with new W2k SP4 patch 12 Nov 03.
• Patches ms03-041 to ms03-045 re-released 23 Oct 03, with a working update.exe installer. Or was it ms03-042, -043 and -045 only, on 30 Oct 03?
  Windows Product Updates May Stop Responding or May Use Most or All the CPU Resources http://support.microsoft.com/kb/830846
  Issues with MS03-043 http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0091.html http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0096.html
  Anyone running SUS see the content update today? http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012574.html
• Buffer Overrun in the ListBox and in the ComboBox Control Could Allow Code Execution (824141) http://www.microsoft.com/technet/security/bulletin/ms03-045.mspx
  Re-released 22 Oct 03 with correct non-English versions.
  Noted on 4 Nov 03 that it supercedes ms02-071.
  See also: Patch MS03-045 for Czech W2K has conflicting kernel32.dll http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0072.html
  New Microsoft security bulletins today http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012170.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012200.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012215.html
  Listbox And Combobox Control Buffer Overflow http://www.securityfocus.com/archive/1/341454
  MS03-045 or Q824141 http://archives.neohapsis.com/archives/ntbugtraq/2004-q1/0072.html
• Buffer Overrun in Windows Help and Support Center Could Lead to System Compromise (825119) http://www.microsoft.com/technet/security/bulletin/ms03-044.mspx
• Buffer Overrun in Messenger Service Could Allow Code Execution (828035) http://www.microsoft.com/technet/security/bulletin/ms03-043.mspx
  Re-released 14 Nov 03 so WinXP would be patched correctly.
  See also: MS03-043 Popup Messenger Servce buffer-overflow http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0077.html
• (W2k) Buffer Overflow in Windows Troubleshooter ActiveX Control Could Allow Code Execution (826232) http://www.microsoft.com/technet/security/bulletin/ms03-042.mspx
  See also: Microsoft Local Troubleshooter ActiveX control buffer overflow http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012205.html
• Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182) http://www.microsoft.com/technet/security/bulletin/ms03-041.mspx
  See also: Problems with windows update installing KB823182 on NT4 Server http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0244.html
  See also: Microsoft PCHealth 2003/XP Buffer Overflow (#NISR15102003) http://www.securityfocus.com/archive/1/341450
• Update for Windows Media Player Script Commands http://support.microsoft.com/kb/828026
  Referenced in ms03-040, to fix the "URL flip" exploits: why does not it deserve a security bulletin?
• Cumulative Patch for Internet Explorer (828750) http://www.microsoft.com/technet/security/bulletin/ms03-040.mspx
• The "Level1Add" Registry Key Is Missing from Outlook 2002 http://support.microsoft.com/kb/312834
  See also: http://support.microsoft.com/kb/290497
  (This is all old info, I just missed it somehow...)
• Buffer Overrun In RPCSS Service Could Allow Code Execution (824146) http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx
  This second try (after ms03-026) still does not seem to work:
  Bad news on RPC DCOM vulnerability http://www.securityfocus.com/archive/1/340937 http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011898.html
  AL-2003.20 Microsoft RPC Race Condition Denial of Service http://www.auscert.org.au/render.html?it=3532
  Microsoft Windows DCOM/RPC vulnerability http://www.kb.cert.org/vuls/id/547820
  See also:
  EEYE: Microsoft RPC Heap Corruption Vulnerability - Part II http://www.securityfocus.com/archive/1/337008
  NSFOCUS SA2003-06 : Microsoft Windows RPC DCOM Interface Heap Overflow Vulnerability http://archives.neohapsis.com/archives/ntbugtraq/2003-q3/0234.html
  Scanning Tool to Identify Host Computers That Do Not Have the 823980 (MS03-026) and the 824146 (MS03-039) Security Patches Installed http://support.microsoft.com/kb/827363
• Unchecked buffer in Microsoft Access Snapshot Viewer Could Allow Code Execution (827104) http://www.microsoft.com/technet/security/bulletin/ms03-038.mspx
• Flaw in Visual Basic for Applications Could Allow Arbitrary Code execution (822715) http://www.microsoft.com/technet/security/bulletin/ms03-037.mspx
  See also:
  EEYE: VBE Document Property Buffer Overflow http://www.securityfocus.com/archive/1/336027
• Buffer Overrun in WordPerfect Converter Could Allow Code Execution (827103) http://www.microsoft.com/technet/security/bulletin/ms03-036.mspx
  See also:
  EEYE: Microsoft WordPerfect Document Converter Buffer Overflow http://www.securityfocus.com/archive/1/336018
• Flaw in Microsoft Word Could Enable Macros to Run Automatically (827653) http://www.microsoft.com/technet/security/bulletin/ms03-035.mspx
• Flaw in NetBIOS Could Lead to Information Disclosure (824105) http://www.microsoft.com/technet/security/bulletin/ms03-034.mspx
• Unchecked Buffer in MDAC Function Could Enable System Compromise (823718) http://www.microsoft.com/technet/security/bulletin/ms03-033.mspx
• Cumulative Patch for Internet Explorer (822925) http://www.microsoft.com/technet/security/bulletin/ms03-032.mspx
  Updated 8 Sep 03: problems acknowledged, investigating, will re-issue... Superceded by ms03-040 on 4 Oct 03.
  See also: http://www.kb.cert.org/vuls/id/865940
  See also: DNS/Hosts file issues http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0007.html
  See also:
  EEYE: Internet Explorer Object Data Remote Execution Vulnerability http://www.securityfocus.com/archive/1/334405
  [SNS Advisory No.67] The Return of the Content-Disposition Vulnerability in IE http://www.securityfocus.com/archive/1/334358
  Re: Alert: Microsoft Security Bulletin - MS03-032 http://archives.neohapsis.com/archives/ntbugtraq/2003-q3/0197.html
  BAD NEWS: Microsoft Security Bulletin MS03-032 http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009639.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009658.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009665.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009671.html
• Unchecked Buffer in DirectX Could Enable System Compromise (819696) http://www.microsoft.com/technet/security/bulletin/ms03-030.mspx
  See also:
  EEYE: Windows MIDI Decoder (QUARTZ.DLL) Heap Corruption http://www.securityfocus.com/archive/1/330181
  http://www.cert.org/advisories/CA-2003-18.html
  Patches for more DirectX versions added 20 Aug 03.
• (WNT) Flaw in Windows Function Could Allow Denial of Service (823803) http://www.microsoft.com/technet/security/bulletin/ms03-029.mspx
  See also:
  MS03-029 / Q823803 and RRAS Problems [im] http://www.securityfocus.com/archive/1/330916
  Re-released to correct RAS on 14 Aug 03.
• (WXP) Unchecked Buffer in Windows Shell Could Enable System Compromise (821557) http://www.microsoft.com/technet/security/bulletin/ms03-027.mspx
• Buffer Overrun In RPC Interface Could Allow Code Execution (823980) http://www.microsoft.com/technet/security/bulletin/ms03-026.mspx
  Note 11 Sep 03: Superceded by ms03-039.
  See also:
  [LSD] Critical security vulnerability in Microsoft Operating Systems http://www.securityfocus.com/archive/1/329516 http://www.securityfocus.com/archive/1/329668
  Microsoft Windows 2000 RPC DCOM Interface DOS AND Privilege Escalation Vulnerability http://www.securityfocus.com/archive/1/329755 http://www.securityfocus.com/archive/1/329957
  RPC DCOM still vulnerable even after applying patches http://archives.neohapsis.com/archives/ntbugtraq/2003-q3/0070.html http://www.securityfocus.com/archive/1/330886
  DCOM Exploit MS03-026 attack vectors http://lists.grok.org.uk/pipermail/full-disclosure/2003-August/007449.html
  Scanning Tool to Identify Host Computers That Do Not Have the 823980 Security Patch (MS03-026) Installed http://support.microsoft.com/kb/826369
• (W2k) Flaw in Windows Message Handling through Utility Manager Could Enable Privilege Elevation (822679) http://www.microsoft.com/technet/security/bulletin/ms03-025.mspx
• Buffer Overrun in Windows Could Lead to Data Corruption (817606) http://www.microsoft.com/technet/security/bulletin/ms03-024.mspx
  Note thanks to Samba team!
• Buffer Overrun In HTML Converter Could Allow Code Execution (823559) http://www.microsoft.com/technet/security/bulletin/ms03-023.mspx
• (W2k) If you are using Windows 2000 then you should install Service Pack 4. See the release notes at http://support.microsoft.com/kb/813432, and the list of included (security) patches at http://www.microsoft.com/technet/security/news/w2kSP4.asp or http://support.microsoft.com/kb/327194
  See also:
  What Win2k SP4 doesn't fix (security), but says it does... http://www.securityfocus.com/archive/1/328233
• Flaw In Windows Media Player May Allow Media Library Access (819639) http://www.microsoft.com/technet/security/bulletin/ms03-021.mspx
• Cumulative Patch for Internet Explorer (818529) http://www.microsoft.com/technet/security/bulletin/ms03-020.mspx
• Flaw in Windows Media Player Skins Downloading could allow Code Execution (817787) http://www.microsoft.com/technet/security/bulletin/ms03-017.mspx
• Cumulative Patch for Internet Explorer (813489) http://www.microsoft.com/technet/security/bulletin/ms03-015.mspx
• Cumulative Patch for Outlook Express (330994) http://www.microsoft.com/technet/security/bulletin/ms03-014.mspx
  See also: MS update 330994 http://lists.grok.org.uk/pipermail/full-disclosure/2004-January/015166.html
• Buffer Overrun in Windows Kernel Message Handling could Lead to Elevated Privileges (811493) http://www.microsoft.com/technet/security/bulletin/ms03-013.mspx
  Updated WinXP SP1 patch added 28 May 03.
• Flaw in Microsoft VM Could Enable System Compromise (816093) http://www.microsoft.com/technet/security/bulletin/ms03-011.mspx
• Flaw in RPC Endpoint Mapper Could Allow Denial of Service Attacks (331953) http://www.microsoft.com/technet/security/bulletin/ms03-010.mspx
  Interesting how WinNT is affected but cannot be patched.
  In fact you need instead (or also?) "private patch" 814408, see:
  Re: Alert: Microsoft Security Bulletin - MS03-010 http://archives.neohapsis.com/archives/ntbugtraq/2003-q2/0058.html http://archives.neohapsis.com/archives/ntbugtraq/2003-q2/0064.html http://archives.neohapsis.com/archives/ntbugtraq/2003-q2/0070.html
  Or is it really 814119 that you need (released 13 May 03)?
• Flaw in Windows Script Engine could allow code execution (814078) http://www.microsoft.com/technet/security/bulletin/ms03-008.mspx
• (W2k) Unchecked buffer in Windows component could cause web server compromise (815021) http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx
  Description updated 18 Mar 03 with details when patch may not work.
  WinNT patch added 23 Apr 03.
  WinXP patch added 28 May 03.
  Install this even if not running IIS: ntdll.dll is a core operating system DLL that exports hundreds of functions for Win32 API programmers to use, and is most likely used by every process running on a Windows 2000 system.
  See also:
  New attack vectors and a vulnerability dissection of MS03-007 http://www.securityfocus.com/archive/1/315845
• (Wme) Flaw in Windows Me Help and Support Center Could Enable Code Execution (812709) http://www.microsoft.com/technet/security/bulletin/ms03-006.mspx
  See also:
  MS-Windows ME IE/Outlook/HelpCenter critical vulnerability http://www.securityfocus.com/archive/1/313362 http://www.securityfocus.com/archive/1/313425
• (WXP) Unchecked Buffer in Windows Redirector Could Allow Privilege Elevation (810577) http://www.microsoft.com/technet/security/bulletin/ms03-005.mspx
• Cumulative Patch for Internet Explorer (810847) http://www.microsoft.com/technet/security/bulletin/ms03-004.mspx
  Re-released 12 Feb 03: also need hotfixes 813951 and 331906.
• Flaw in how Outlook 2002 handles V1 Exchange Server Security Certificates could lead to Information Disclosure (812262) http://www.microsoft.com/technet/security/bulletin/ms03-003.mspx
• Unchecked Buffer in Locator Service Could Lead to Code Execution (810833) http://www.microsoft.com/technet/security/bulletin/ms03-001.mspx
• (WXP) Unchecked Buffer in Windows Shell Could Enable System Compromise (329390) http://www.microsoft.com/technet/security/bulletin/ms02-072.mspx
• Flaw in Windows WM_TIMER Message Handling Could Enable Privilege Elevation (328310) http://www.microsoft.com/technet/security/bulletin/ms02-071.mspx
  See also:
  A patch for "Windows WM_TIMER Message Handling flaw" causes random crashes on Windows NT http://www.securityfocus.com/archive/1/306436
  WinNT patch pulled out on 3 Feb 03 as it causes crashes; patch re-released on 7 Feb 03.
  MS Security Bulletin MS02-071 changes group policies http://archives.neohapsis.com/archives/ntbugtraq/2003-q1/0079.html
• Flaw in SMB Signing Could Enable Group Policy to be Modified (309376) http://www.microsoft.com/technet/security/bulletin/ms02-070.mspx
  Re-released with WXP patches on 22 Jan 03.
• Flaw in Microsoft VM Could Enable System Compromise (810030) http://www.microsoft.com/technet/security/bulletin/ms02-069.mspx
  Note KB article 313191 how WindowsUpdate does not work on WinNT, and the complex procedures a WinNT user must follow to download the VM patch.
• Cumulative Patch for Internet Explorer (324929) http://www.microsoft.com/technet/security/bulletin/ms02-068.mspx
  See also:
  Notes on MS02-068, extensive downplaying of severity http://www.securityfocus.com/archive/1/302174
  Security rating and impacts revised on 6 Dec 02; pointer to KB article 810687 added or emphasized (seems we need that too).
• E-mail Header Processing Flaw Could Cause Outlook 2002 to Fail (331866) http://www.microsoft.com/technet/security/bulletin/ms02-067.mspx
• Cumulative Patch for Internet Explorer (Q328970) http://www.microsoft.com/technet/security/bulletin/ms02-066.mspx
  Does not seem to include ms02-065.
  Re-released, with (broken) pointer to KB article 810687 on 25 Nov 02: need that even after the patch?
  Severity rating revised on 13 Dec 02 (after superceded by ms02-068)
  See also:
  Re: MS02-066 - fixes, gaps and incorrect statements http://www.securityfocus.com/archive/1/300977
• Buffer Overrun in Microsoft Data Access Components Could Lead to Code Execution (Q329414) http://www.microsoft.com/technet/security/bulletin/ms02-065.mspx
  Note the caveat: ... a patched system could be made vulnerable again [by] visit a web site or open an HTML mail ...
  Note the workaround: make sure you have no trusted publishers, including Microsoft.
• Windows 2000 Default Permissions Could Allow Trojan Horse Program (Q327522) http://www.microsoft.com/technet/security/bulletin/ms02-064.mspx
• Unchecked Buffer in PPTP Implementation Could Enable Denial of Service Attacks (Q329834) http://www.microsoft.com/technet/security/bulletin/ms02-063.mspx
• (WXP) Flaw in Windows XP Help and Support Center Could Enable File Deletion (Q328940) http://www.microsoft.com/technet/security/bulletin/ms02-060.mspx
• Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure (Q330008) http://www.microsoft.com/technet/security/bulletin/ms02-059.mspx
• Unchecked Buffer in Outlook Express S/MIME Parsing Could Enable System Compromise (Q328676) http://www.microsoft.com/technet/security/bulletin/ms02-058.mspx
• Flaw in Services for Unix 3.0 Interix SDK Could Allow Code Execution (Q329209) http://www.microsoft.com/technet/security/bulletin/ms02-057.mspx
• Unchecked Buffer in Windows Help Facility Could Enable Code Execution (Q323255) http://www.microsoft.com/technet/security/bulletin/ms02-055.mspx
• (W98, WXP) Unchecked Buffer in File Decompression Functions Could Lead to Code Execution (Q329048) http://www.microsoft.com/technet/security/bulletin/ms02-054.mspx
• Flaw in Microsoft VM JDBC Classes Could Allow Code Execution (Q329077) http://www.microsoft.com/technet/security/bulletin/ms02-052.mspx
  See also: http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001276.html http://lists.grok.org.uk/pipermail/full-disclosure/2002-September/001703.html
• (W2k) Cryptographic Flaw in RDP Protocol can Lead to Information Disclosure (Q324380) http://www.microsoft.com/technet/security/bulletin/ms02-051.mspx
• Internet Explorer 6 Service Pack 1 released on 9 Sep 02: http://www.microsoft.com/windows/ie/downloads/critical/ie6sp1/default.asp
  (Why no security bulletin?)
  See also (USyd users in particular!):
  IE proxy authentication problem and a hotfix http://mailman.ucc.usyd.edu.au/pipermail/its-contacts/2003-April/000375.html http://support.microsoft.com/kb/331906
• Flaw Could Enable Web Page to Launch Visual FoxPro 6.0 Application Without Warning (Q326568) http://www.microsoft.com/technet/security/bulletin/ms02-049.mspx
• Flaw in Certificate Enrollment Control Could Allow Deletion of Digital Certificates (Q323172) http://www.microsoft.com/technet/security/bulletin/ms02-048.mspx
• Cumulative Patch for Internet Explorer (Q323759) http://www.microsoft.com/technet/security/bulletin/ms02-047.mspx
• Buffer Overrun in TSAC ActiveX Control Could Allow Code Execution (Q327521) http://www.microsoft.com/technet/security/bulletin/ms02-046.mspx
• (W2k) Unchecked Buffer in Network Share Provider Can Lead to Denial of Service (Q326830) http://www.microsoft.com/technet/security/bulletin/ms02-045.mspx
• Unsafe Functions in Office Web Components (Q328130) http://www.microsoft.com/technet/security/bulletin/ms02-044.mspx
• (W2k) Flaw in Network Connection Manager Could Enable Privilege Elevation (Q326886) http://www.microsoft.com/technet/security/bulletin/ms02-042.mspx
• (W2k) If you are using Windows 2000 then you should install Service Pack 3. See the list of included security patches at http://www.microsoft.com/technet/security/news/w2ksp3.asp or http://support.microsoft.com/kb/320853
  (Patches for MS Office, Media Player, or Internet Explorer 5.5 or later, are not included; seems all other patches below are included.)
  BEWARE new privacy issues, see http://www.securityfocus.com/archive/1/285638
  With SP3, you can "hide" IE, OE and WMP, see http://support.microsoft.com/kb/324644
• Cumulative Patch for Windows Media Player (Q320920) http://www.microsoft.com/technet/security/bulletin/ms02-032.mspx
  Re-released with missing patch on 24 Jul 02.
• Cumulative Patches for Excel and Word for Windows (Q324458) http://www.microsoft.com/technet/security/bulletin/ms02-031.mspx
• (W2k) Unchecked Buffer in Remote Access Service Phonebook Could Lead to Code Execution (Q318138) http://www.microsoft.com/technet/security/bulletin/ms02-029.mspx
  Re-released with new patches (to correct VPN) on 2 Jul 02.
  See also:
  Re: VPN and Q318138--Workaround http://archives.neohapsis.com/archives/ntbugtraq/2002-q2/0148.html
• Unchecked Buffer in Gopher Protocol Handler Can Run Code of Attacker's Choice (Q323889) http://www.microsoft.com/technet/security/bulletin/ms02-027.mspx
  Just workaround instructions on 12 Jun 02; patch in ms02-047.
  See also:
  Flawed workaround in MS02-027 -- gopher can run on _any_ port, not just 70 http://www.securityfocus.com/archive/1/276848
• Unchecked Buffer in MSN Chat Control Can Lead to Code Execution (Q321661) http://www.microsoft.com/technet/security/bulletin/ms02-022.mspx
  Re-released with new patches on 11 Jun 02.
• (W2k) Authentication Flaw in Windows Debugger can Lead to Elevated Privileges (Q320206) http://www.microsoft.com/technet/security/bulletin/ms02-024.mspx
• 15 May 2002 Cumulative Patch for Internet Explorer (Q321232) http://www.microsoft.com/technet/security/bulletin/ms02-023.mspx
  See also:
  MS02-023 does not patch actual issue! http://www.securityfocus.com/archive/1/272689
  Update and comments on the MS02-023 patch, holes still remain http://www.securityfocus.com/archive/1/272695 http://www.securityfocus.com/archive/1/272883
  MS02-023 Patch Breaks JAVASCRIPT http://archives.neohapsis.com/archives/ntbugtraq/2002-q2/0106.html
• Outlook E-mail Attachment Security Update:
  OL98: http://support.microsoft.com/kb/262617
  OL2000: http://support.microsoft.com/kb/262631
  See also:
  Outlook Security Features http://www.microsoft.com/office/outlook/evaluation/security.asp
  Downloads for Outlook Users http://www.microsoft.com/office/outlook/downloads/
  (This is all old info, I just missed it somehow...)
• E-mail Editor Flaw Could Lead to Script Execution on Reply or Forward (Q321804) http://www.microsoft.com/technet/security/bulletin/ms02-021.mspx
• (W2k) Q311967: Unchecked buffer in the Multiple UNC Provider Could Enable Code Execution http://www.microsoft.com/technet/security/bulletin/ms02-017.mspx
  See also:
  Re: NSFOCUS SA2002-02 : Microsoft Windows MUP overlong request kernel overflow http://www.securityfocus.com/archive/1/268644
• (W2k) Q318593: Opening Group Policy Files for Exclusive Read Blocks Policy Application http://www.microsoft.com/technet/security/bulletin/ms02-016.mspx
• 28 March 2002 Cumulative Patch for Internet Explorer http://www.microsoft.com/technet/security/bulletin/ms02-015.mspx
  Cumulative: bah... fine print changed later to say that ms02-009 is not included.
  See also:
  IE: Remote webpage can script in local zone http://www.securityfocus.com/archive/1/265459
  MS02-015 (Q319182) breaks intranet cookies http://archives.neohapsis.com/archives/ntbugtraq/2002-q2/0027.html
• Unchecked Buffer in Windows Shell Could Lead to Code Execution http://www.microsoft.com/technet/security/bulletin/ms02-014.mspx
• Java Applet Can Redirect Browser Traffic http://www.microsoft.com/technet/security/bulletin/ms02-013.mspx
• Unchecked Buffer in ISAPI Filter Could Allow Commerce Server Compromise http://www.microsoft.com/technet/security/bulletin/ms02-010.mspx
• Incorrect VBScript Handling in IE can Allow Web Pages to Read Local Files http://www.microsoft.com/technet/security/bulletin/ms02-009.mspx
• XMLHTTP Control Can Allow Access to Local Files http://www.microsoft.com/technet/security/bulletin/ms02-008.mspx
• Unchecked Buffer in SNMP Service Could Enable Arbitrary Code to be Run http://www.microsoft.com/technet/security/bulletin/ms02-006.mspx (SNMP is not installed or running by default, so may not need patching. Except on Dell servers where it is on in the OEM media...)
• 11 February 2002 Cumulative Patch for Internet Explorer http://www.microsoft.com/technet/security/bulletin/ms02-005.mspx
• (W2k) Unchecked Buffer in Telnet Server Could Lead to Arbitrary Code Execution: http://www.microsoft.com/technet/security/bulletin/ms02-004.mspx
• (W2k) Windows 2000 Security Rollup Package 1 Now Available: http://www.microsoft.com/technet/security/news/w2ksrp1.asp
  This is documented not to contain patches that were delivered after MS01-052, later changed (?!) to MS01-022 and after MS02-004 with the exception of MS02-011 (and may have missed others). It is recommended anyway, as it seems to contain other (undocumented) patches e.g. Q300367 .
• (W2k) Trusting Domains Do Not Verify Domain Membership of SIDs in Authorization Data: http://www.microsoft.com/technet/security/bulletin/ms02-001.mspx
• (W98,XP) Unchecked Buffer in Universal Plug and Play can Lead to System Compromise: http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx
• 13 December 2001 Cumulative Patch for IE: http://www.microsoft.com/technet/security/bulletin/ms01-058.mspx
• Windows Media Player .ASF Processor Contains Unchecked Buffer: http://www.microsoft.com/technet/security/bulletin/ms01-056.mspx
• Cookie Data in IE Can Be Exposed or Altered Through Script Injection: http://www.microsoft.com/technet/security/bulletin/ms01-055.mspx
  See also:
  Re: Microsoft IE cookies readable via about: URLS http://www.securityfocus.com/archive/1/225567 and http://www.securityfocus.com/archive/1/240091
  Re: Microsoft Security Bulletin MS01-055 http://www.securityfocus.com/archive/1/234674
• (W98,XP) Invalid Universal Plug and Play Request can Disrupt System Operation: http://www.microsoft.com/technet/security/bulletin/ms01-054.mspx
• (W2k) Invalid RDP Data can Cause Terminal Service Failure: http://www.microsoft.com/technet/security/bulletin/ms01-052.mspx
• Malformed Dotless IP Address Can Cause Web Page to be Handled in Intranet Zone: http://www.microsoft.com/technet/security/bulletin/ms01-051.mspx
• Malformed Excel or PowerPoint Document Can Bypass Macro Security: http://www.microsoft.com/technet/security/bulletin/ms01-050.mspx
• Windows Media Player .NSC Processor Contains Unchecked Buffer: http://www.microsoft.com/technet/security/bulletin/ms01-042.mspx
• (W2k) Malformed RPC Request Can Cause Service Failure: http://www.microsoft.com/technet/security/bulletin/ms01-041.mspx
• Outlook View Control Exposes Unsafe Functionality: http://www.microsoft.com/technet/security/bulletin/ms01-038.mspx
• (W2k) Authentication Error in SMTP Service Could Allow Mail Relaying: http://www.microsoft.com/technet/security/bulletin/ms01-037.mspx
• Malformed Word Document Could Enable Macro to Run Automatically: http://www.microsoft.com/technet/security/bulletin/ms01-034.mspx
• (W2k) Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise: http://www.microsoft.com/technet/security/bulletin/ms01-033.mspx
• (W2k) Predictable Name Pipes Could Enable Privilege Elevation via Telnet: http://www.microsoft.com/technet/security/bulletin/ms01-031.mspx
• Incorrect Attachment Handling in Exchange 2000 OWA Can Execute Script: http://www.microsoft.com/technet/security/bulletin/ms01-030.mspx
• HyperTerminal Buffer Overflow: http://www.microsoft.com/technet/security/bulletin/ms00-079.mspx
  [Re-release with new content]
• Windows Media Player .ASX Processor Contains Unchecked Buffer: http://www.microsoft.com/technet/security/bulletin/ms01-029.mspx
• RTF document linked to template can run macros without warning: http://www.microsoft.com/technet/security/bulletin/ms01-028.mspx
• Flaws in Web Server Certificate Validation Could Enable Spoofing: http://www.microsoft.com/technet/security/bulletin/ms01-027.mspx
• WebDAV Service Provider Can Allow Scripts to Levy Requests as User: http://www.microsoft.com/technet/security/bulletin/ms01-022.mspx
• (W2k) If you are using Windows 2000 then you should install Service Pack 2. See the list of included security patches at http://www.microsoft.com/technet/security/news/w2ksp2.asp or http://support.microsoft.com/kb/298193 and note that many (but not all: e.g. ms01-007 and ms00-029!) of the patches below are included. (Patches for MS Office, Media Player, or Internet Explorer 5.5 or later, are not included.) From this point I will try and also include Windows 2000 patches, and mark those that are relevant only to Windows 98 or to Windows 2000. (BEWARE: Up until here I skipped patches that were just for Windows 2000.)
• Incorrect MIME Header Can Cause IE to Execute E-mail Attachment: http://www.microsoft.com/technet/security/bulletin/ms01-020.mspx
• Passwords for Compressed Folders are Recoverable: http://www.microsoft.com/technet/security/bulletin/ms01-019.mspx
• Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard: http://www.microsoft.com/technet/security/bulletin/ms01-017.mspx
• IE can Divulge Location of Cached Content: http://www.microsoft.com/technet/security/bulletin/ms01-015.mspx
  [Got to love that obfuscated wording...]
• Outlook, Outlook Express Vcard Handler Contains Unchecked Buffer: http://www.microsoft.com/technet/security/bulletin/ms01-012.mspx
• Windows Media Player Skins File Download: http://www.microsoft.com/technet/security/bulletin/ms01-010.mspx
• (W2k) Network DDE Agent Requests can Enable Code to run in System Context: http://www.microsoft.com/technet/security/bulletin/ms01-007.mspx
• PowerPoint File Parsing: http://www.microsoft.com/technet/security/bulletin/ms01-002.mspx
• Web Client NTLM Authentication: http://www.microsoft.com/technet/security/bulletin/ms01-001.mspx
• Browser Print Template, File Upload via Form: http://www.microsoft.com/technet/security/bulletin/ms00-093.mspx
• Incomplete TCP/IP Packet: http://www.microsoft.com/technet/security/bulletin/ms00-091.mspx
• Windows Media Player .ASX Buffer Overrun and .WMS Script Execution: http://www.microsoft.com/technet/security/bulletin/ms00-090.mspx
• New Variant of VM File Reading: http://www.microsoft.com/technet/security/bulletin/ms00-081.mspx
• HyperTerminal Buffer Overflow: http://www.microsoft.com/technet/security/bulletin/ms00-079.mspx
• Cached Web Credentials: http://www.microsoft.com/technet/security/bulletin/ms00-076.mspx
• Microsoft VM ActiveX Component (includes Java VM Applet MS00-059): http://www.microsoft.com/technet/security/bulletin/ms00-075.mspx
• Malformed IPX NMPI Packet: http://www.microsoft.com/technet/security/bulletin/ms00-073.mspx
• Share Level Password: http://www.microsoft.com/technet/security/bulletin/ms00-072.mspx
• Word Mail Merge: http://www.microsoft.com/technet/security/bulletin/ms00-071.mspx
• OCX Attachment: http://www.microsoft.com/technet/security/bulletin/ms00-068.mspx
• Money Password: http://www.microsoft.com/technet/security/bulletin/ms00-061.mspx
• Scriptlet Rendering (includes IE Script part of MS00-049; SSL Certificate Validation MS00-039; Frame Domain, Cookie Access etc MS00-033; for IE5.5 includes also Active Setup Download MS00-042): http://www.microsoft.com/technet/security/bulletin/ms00-055.mspx
• Office HTML Object Tag: http://www.microsoft.com/technet/security/bulletin/ms00-056.mspx
• Excel REGISTER.ID Function: http://www.microsoft.com/technet/security/bulletin/ms00-051.mspx
• Cache Bypass (MS00-046), Persistent Mail-Browser Link (MS00-045), Malformed E-mail Header (MS00-043) share the same patch: http://www.microsoft.com/technet/security/bulletin/ms00-046.mspx http://www.microsoft.com/technet/security/bulletin/ms00-045.mspx http://www.microsoft.com/technet/security/bulletin/ms00-043.mspx
• Office HTML Script: http://www.microsoft.com/technet/security/bulletin/ms00-049.mspx
• Active Setup Download: http://www.microsoft.com/technet/security/bulletin/ms00-042.mspx
• SSL Certificate Validation (includes MS00-033: Frame Domain, Cookie Access etc): http://www.microsoft.com/technet/security/bulletin/ms00-039.mspx
• HTML Help File Code Execution: http://www.microsoft.com/technet/security/bulletin/ms00-037.mspx
• Computer Browser protocol: http://www.microsoft.com/technet/security/bulletin/ms00-036.mspx
  But there is no Win98 patch! Looking in the FAQ http://www.microsoft.com/technet/security/bulletin/fq00-036.mspx and the KB article http://support.microsoft.com/kb/262694 ( http://support.microsoft.com/kb/263307 is useless), it seems we need to create the registry keys:

  Hive	HKEY_LOCAL_MACHINE\SYSTEM
  Key	CurrentControlSet\Services\MrxSmb\Parameters
  Name	RefuseReset
  Value Type	DWORD
  Default Value	None (ResetBrowser frames are accepted)
  ... but set to	0x01 to ignore ResetBrowser frames

  Hive	HKEY_LOCAL_MACHINE\SYSTEM
  Key	CurrentControlSet\Services\MrxSmb\Parameters
  Name	MaximumBrowseEntries
  Value Type	DWORD
  Default Value	100000
  ... but set to	1 or 0 (?)

  Use regedit to create those two keys; this may not be effective on Win98 (it does not seem to have Mrxsmb.sys or Rdr.sys files).
• IP Fragment Reassembly: http://www.microsoft.com/technet/security/bulletin/ms00-029.mspx
• Office 2000 UA Control: http://www.microsoft.com/technet/security/bulletin/ms00-034.mspx
• XLM Text Macro: http://www.microsoft.com/technet/security/bulletin/ms00-022.mspx
• DOS Device in Path Name: http://www.microsoft.com/technet/security/bulletin/ms00-017.mspx
  See also: http://www.securityfocus.com/archive/1/195294 http://www.securityfocus.com/archive/1/195453
• Clip Art Buffer Overrun: http://www.microsoft.com/technet/security/bulletin/ms00-015.mspx
• VM File Reading: http://www.microsoft.com/technet/security/bulletin/ms00-011.mspx
• Image Source Redirect: http://www.microsoft.com/technet/security/bulletin/ms00-009.mspx
• Malformed RTF Control Word: http://www.microsoft.com/technet/security/bulletin/ms00-005.mspx
• Malformed Conversion Data: http://www.microsoft.com/technet/security/bulletin/ms00-002.mspx
• Server-side Page Reference Redirect: http://www.microsoft.com/technet/security/bulletin/ms99-050.mspx
• WPAD Spoofing: http://www.microsoft.com/technet/security/bulletin/ms99-054.mspx
• Legacy Credential Caching: http://www.microsoft.com/technet/security/bulletin/ms99-052.mspx
• IE Task Scheduler: http://www.microsoft.com/technet/security/bulletin/ms99-051.mspx
• File Access URL: http://www.microsoft.com/technet/security/bulletin/ms99-049.mspx
• Active Setup Control: http://www.microsoft.com/technet/security/bulletin/ms99-048.mspx
• Virtual Machine Verifier: http://www.microsoft.com/technet/security/bulletin/ms99-045.mspx
• Excel SYLK: http://www.microsoft.com/technet/security/bulletin/ms99-044.mspx
• Javascript Redirect: http://www.microsoft.com/technet/security/bulletin/ms99-043.mspx
• IFRAME ExecCommand: http://www.microsoft.com/technet/security/bulletin/ms99-042.mspx
• Spoofed Route Pointer: http://www.microsoft.com/technet/security/bulletin/ms99-038.mspx
• ImportExportFavorites: http://www.microsoft.com/technet/security/bulletin/ms99-037.mspx
• Malformed Telnet Argument: http://www.microsoft.com/technet/security/bulletin/ms99-033.mspx
• Fragmented IGMP Packet: http://www.microsoft.com/technet/security/bulletin/ms99-034.mspx
• scriptlet.typelib/Eyedog: http://www.microsoft.com/technet/security/bulletin/ms99-032.mspx
• Virtual Machine Sandbox: http://www.microsoft.com/technet/security/bulletin/ms99-031.mspx
• Office ODBC Vulnerabilities: http://www.microsoft.com/technet/security/bulletin/ms99-030.mspx
• Malformed Favorites Icon: http://www.microsoft.com/technet/security/bulletin/ms99-018.mspx
• Excel 97 Virus Warning Vulnerabilities: http://www.microsoft.com/technet/security/bulletin/ms99-014.mspx
• MSHTML Update Available for Internet Explorer: http://www.microsoft.com/technet/security/bulletin/ms99-012.mspx
• DHTML Edit: http://www.microsoft.com/technet/security/bulletin/ms99-011.mspx
• Taskpads Scripting: http://www.microsoft.com/technet/security/bulletin/ms99-007.mspx
• Word 97 Template: http://www.microsoft.com/technet/security/bulletin/ms99-002.mspx
• Exposure in Forms 2.0 TextBox Control that allows data to be read from user's Clipboard: http://www.microsoft.com/technet/security/bulletin/ms99-001.mspx
• Frame Spoof: http://www.microsoft.com/technet/security/bulletin/ms98-020.mspx
• Excel CALL: http://www.microsoft.com/technet/security/bulletin/ms98-018.mspx
• Dotless IP Address Issue in Microsoft Internet Explorer 4: http://www.microsoft.com/technet/security/bulletin/ms98-016.mspx
• Untrusted Scripted Paste Issue in Microsoft Internet Explorer 4.01: http://www.microsoft.com/technet/security/bulletin/ms98-015.mspx
• Internet Explorer Cross Frame Navigate: http://www.microsoft.com/technet/security/bulletin/ms98-013.mspx
• Updates available for Security Vulnerabilities in Microsoft PPTP: http://www.microsoft.com/technet/security/bulletin/ms98-012.mspx
• Window.External JScript Vulnerability in Microsoft Internet Explorer 4.0: http://www.microsoft.com/technet/security/bulletin/ms98-011.mspx
• Long file name Security Issue affecting Microsoft Outlook 98 and Microsoft Outlook Express 4.x: http://www.microsoft.com/technet/security/bulletin/ms98-008.mspx

Reference(s):
http://www.microsoft.com/technet/security/default.mspx
http://www.microsoft.com/technet/security/currentdl.aspx

Paul Szabo psz@maths.usyd.edu.au 13 May 09