• A previously public (Nov 1, 2011) remote code-execution vulnerability affects Windows kernel-mode drivers when handling specially crafted TrueType fonts.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file, or viewing a malicious web page.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the kernel. This may facilitate a complete system compromise.

Microsoft Word Access Violation Remote Code Execution Vulnerability
Remote Code Execution Vulnerability

• A remote code-execution vulnerability affects Word when handling specially crafted Word files.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects the Microsoft Time ActiveX control.
• An attacker can exploit this issue by tricking an unsuspecting victim into viewing a malicious web page.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects Publisher when handling a specially crafted file.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening malicious ‘.pub’ file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects Media Player and Media Center due to how they handle ‘.dvr-ms’ files.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a malformed file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code with system-level privileges. This may facilitate a complete system compromise.

• A local privilege-escalation vulnerability affects Microsoft Office IME because of how it exposes configurations options.
• A local attacker may be able to exploit this issue to execute arbitrary code with kernel-level privileges.
• This may facilitate a complete system compromise.

• A remote code-execution vulnerability affects Publisher when handling a specially crafted file.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening malicious ‘.pub’ file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects Publisher when handling a specially crafted file.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening malicious ‘.pub’ file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects Object Linking and Embedding (OLE) due to improper handling of OLE objects.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted OLE object.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects PowerPoint due to how it loads DLL files.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a file associated with the application from a remote WebDAV or SMB share.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects PowerPoint when handling specially malformed files.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a malformed PowerPoint file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects Active Directory when accessing a memory buffer that has not been properly initialized.
• An authenticated attacker may be able to exploit this issue to execute arbitrary code in the context of the affected application.
• This may facilitate a complete system compromise.

• A remote code-execution vulnerability affects Excel when handling specially malformed files.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a malformed Excel file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A local privilege-escalation vulnerability affects the Client/Server Run-time Subsystem (CSRSS) when handling device event messages.
• A local attacker may be able to exploit this issue to run arbitrary code in the context of another process.
• This may facilitate a complete system compromise.

• A local privilege-escalation vulnerability affects the Windows kernel when handling an object that has not been properly initialized.
• A local attacker may be able to exploit this issue to run arbitrary code with kernel-level privileges.

• A cross-domain information-disclosure vulnerability affects Internet Explorer.
• An attacker can exploit this issue by tricking an unsuspecting victim into viewing a specially crafted web page.
• A successful exploit will allow an attacker to gain access to potentially sensitive information across domains.

• A remote code-execution vulnerability affects Internet Explorer because of how it loads DLL files.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a file associated with the application from a remote WebDAV or SMB share, or from the local desktop.
• Successful exploits will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A previously public (Sep 19, 2011) information disclosure vulnerability affects the SSL/TLS protocol.
• A man-in-the-middle attacker may be able to guess the ciphertext used in encrypted traffic, allowing them to decrypt HTTPS traffic to a targeted victim.
• The problem occurs due to the way the protocols select the initialization vector (IV) when in CBC (cipher-block chaining) mode.

• A previously public (Oct 12, 2011) remote code-execution vulnerability affects Publisher in the ‘pubconv.dll’ library file.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially malformed ‘.pub’ file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• An information-disclosure vulnerability affects Internet Explorer due to how it renders certain web pages.
• An attacker can exploit this issue by tricking an unsuspecting victim into viewing a specially malformed web page.
• A successful exploit may result in the disclosure of potentially sensitive information across domains.