Dan Hubbard

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel versions 2000 SP3 and 2002 SP2 Microsoft Office versions 2004 and 2008 for Mac **Description** The issue allows remote attackers to execute arbitrary code via crafted conditional formatting values. A remote code execution vulnerability exists in the way Excel handles conditional formatting values. An attacker could exploit the vulnerability by sending a malformed file which could be hosted on a specially crafted or compromised Web site, or included as an e-mail attachment. **Recommendations** For Microsoft Excel 2000 SP3, update to a version that is not affected by this issue. For Microsoft Excel 2002 SP2, update to a version that is not affected by this issue. For Microsoft Office 2004 for Mac, update to a version that is not affected by this issue. For Microsoft Office 2008 for Mac, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of conditional formatting values in Excel until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer version 6.0 Microsoft Outlook (affected versions not specified) Microsoft Windows (affected versions not specified) **Description** The issue is related to a stack-based buffer overflow in the Vector Graphics Rendering engine. It allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag. An attacker could exploit this by constructing a specially crafted Web page or HTML e-mail, potentially allowing remote code execution if a user visited the Web page or viewed the message. This could give the attacker complete control of an affected system. **Recommendations** For Microsoft Internet Explorer version 6.0, update to a newer version to mitigate the risk. For Microsoft Outlook, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Windows, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** A remote code execution issue exists in the Graphics Rendering Engine due to its handling of Windows Metafile (WMF) images. An attacker could exploit this by creating a specially crafted WMF image, potentially allowing remote code execution if a user visits a malicious website or opens a specially crafted email attachment. Successful exploitation could give an attacker complete control of the affected system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.