. The
"critical" bulletins affect Windows GDI, Word, Excel, Internet Explorer and
Windows Search. The "important" updates affect SharePoint and Windows Media
Components.
MS08-070: Critical
- Titled "Vulnerabilities in Visual Basic 6.0 Runtime Extended Files
(ActiveX Controls) Could Allow Remote Code Execution (932349)", this bulletin
affects the Microsoft Visual Basic 6.0 Runtime Extended Files; all supported
editions of Microsoft Visual Studio .Net 2002, Microsoft Visual Studio .Net
2003, Microsoft Visual FoxPro 8.0, Microsoft Visual FoxPro 9.0, Microsoft Office
Project 2003, and Microsoft Office Project 2007.
MS08-071: Critical
- Titled "Vulnerabilities in GDI
Could Allow Remote Code Execution (956802)",
this bulletin is rated critical for all
supported editions of Microsoft Windows 2000,
Windows XP, Windows Server 2003, Windows Vista,
and Windows Server 2008. Microsoft says "exploitation
of either of these vulnerabilities could allow
remote code execution if a user opens a
specially crafted WMF image file. An attacker
who successfully exploited these vulnerabilities
could take complete control of an affected
system. An attacker could then install programs;
view, change, or delete data; or create new
accounts with full user rights.
MS08-072: Critical
- Titled "Vulnerabilities in
Microsoft Office Word Could Allow Remote Code
Execution (957173)," this bulletin is rated
critical for supported editions of Microsoft
Office Word 2000 and Microsoft Office Outlook
2007. For supported editions of Microsoft Office
Word 2002, Microsoft Office Word 2003, Microsoft
Office Word 2007, Microsoft Office Compatibility
Pack, Microsoft Office Word Viewer 2003,
Microsoft Works 8, Microsoft Office 2004 for
Mac, Microsoft Office 2008 for Mac, and Open XML
File Format Converter for Mac, this security
update is rated important. Microsoft says this bulletin
resolves "eight privately reported
vulnerabilities in Microsoft Office Word and
Microsoft Office Outlook that could allow remote
code execution if a user opens a specially
crafted Word or Rich Text Format (RTF) file. An
attacker who successfully exploited these
vulnerabilities could take complete control of
an affected system. An attacker could then
install programs; view, change, or delete data;
or create new accounts with full user rights."
MS08-073: Critical
- Titled "Cumulative Security Update
for Internet Explorer (958215)", this bulletin
is rated critical for Internet Explorer 5.01 and
Internet Explorer 6 Service Pack 1, running on
Microsoft Windows 2000; Internet Explorer 6
running on Windows XP; and Internet Explorer 7.
For Internet Explorer 6 running on Windows
Server 2003, this security update is rated
"moderate."
Microsoft says the vulnerabilities could allow
remote code execution if a user views a
specially crafted Web page using Internet
Explorer.
MS08-074: Critical
- Titled "Vulnerabilities in
Microsoft Office Excel Could Allow Remote Code
Execution (959070)." This bulletin is rated
critical for all supported editions of Microsoft
Office Excel 2000. For all supported editions of
Microsoft Office Excel 2002, Microsoft Office
Excel 2003, Microsoft Office Excel Viewer 2003,
Microsoft Office Excel 2007, Microsoft Office
Compatibility Pack, Microsoft Office Excel
Viewer, Microsoft Office 2004 for Mac, Microsoft
Office 2008 for Mac, and Open XML File Format
Converter for Mac, this security update is rated
important. For Internet Explorer 6 running on
Windows Server 2003, this security update is
rated moderate. Microsoft says
if a user opens a specially crafted Excel file
an attacker could exploit these vulnerabilities
and take complete control of an affected system.
MS08-075: Critical
- Titled "Vulnerabilities in Windows
Search Could Allow Remote Code Execution
(959349)" This bulletin is rated critical for
all supported editions of Windows Vista and
Windows Server 2008. Microsoft says that "these
vulnerabilities could allow remote code
execution if a user opens and saves a specially
crafted saved-search file within Windows
Explorer or if a user clicks a specially crafted
search URL. An attacker who successfully
exploited these vulnerabilities could take
complete control of an affected system."
