Eight vulnerabilities fixed, one IE 0-day warning for Patch Tuesday

After last month’s mammoth Patch Tuesday release, administrators will be glad to know that this month Microsoft delivers only 2 bulletins that fix 8 vulnerabilities targeting Movie Maker and Office, and that their rating is merely “Important”.

Vulnerability in Windows Movie Maker could allow remote code execution
This security update addresses a privately reported vulnerability in Windows Movie Maker and Microsoft Producer 2003. Windows Live Movie Maker, which is available for Windows Vista and Windows 7, is not affected by this vulnerability. The vulnerability could allow remote code execution if an attacker sent a specially crafted Movie Maker or Microsoft Producer project file and convinced the user to open the specially crafted file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Vulnerabilities in Microsoft Office Excel could allow remote code execution
This security update resolves seven privately reported vulnerabilities in Microsoft Office Excel. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Also published today is a security advisory warning of a zero-day vulnerability in Internet Explorer that could allow remote code execution. IE 6 i 7 is affected, but not IE 8.

“The vulnerability exists due to an invalid pointer reference being used within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution,” says in the advisory, adding that they are aware of attackers trying to exploit this vulnerability in the wild, but that they are still working on the solution.