Secunia

Multiple vulnerabilities have been reported in Microsoft Office, which can be exploited by malicious people to compromise a user's system.

1) A boundary error in Excel when processing files with a malformed "Named Range" with negative length values can be exploited to corrupt memory and allows execution of arbitrary code on a user's system when viewing a specially crafted Excel file.

2) A boundary error in Office when processing documents containing a specially crafted "routing slip" can be exploited to corrupt memory and allows execution of arbitrary code on a user's system when the user views and closes a malicious document.

3) An error in Excel when parsing the BIFF file format can be exploited via malformed BOOLERR records to corrupt memory. This allows execution of arbitrary code on a user's system when viewing a specially crafted Excel file.

4) A boundary error in Excel when processing a specially crafted file with an overly large formula size can be exploited to cause a stack-based buffer overflow and allows execution of arbitrary code on a user's system when a malicious Excel file is viewed. An error within the handling of the "Column Index" read from an Excel file can cause Excel to crash due to invalid memory access.

5) An error in Excel when processing malformed graphics can be exploited to corrupt memory and allows execution of arbitrary code on a user's system when viewing a specially crafted Excel file.

6) A boundary error in Excel when processing malformed records with a specially-crafted length value can be exploited to corrupt stack memory and may allow execution of arbitrary code on a user's system when viewing a malicious Excel file.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Peter Winter-Smith of NGSSoftware (the vendor also credits FelicioX).
2) The vendor credits Ollie Whitehouse, Symantec.
3) Arnaud Dovi
4) Dejun Meng, Fortinet Security Response Team.
5) Reported by vendor.
6) The vendor credits Eyas, XFOCUS Security Team.

Changelog
Further details available in Customer Area

Original Advisory
MS06-012 (KB905413):
http://www.microsoft.com/technet/security/Bulletin/MS06-012.mspx

Zero Day Initiative:
http://www.zerodayinitiative.com/advisories/ZDI-06-004.html

HexView:
http://www.hexview.com/docs/20060314-1.txt

XFOCUS Security Team:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/043660.html

Symantec:
http://www.symantec.com/enterprise/research/SYMSA-2006-001.txt

Fortinet:
http://www.fortiguardcenter.com/advisory/FGA-2006-11.html
http://www.fortiguardcenter.com/advisory/FGA-2006-12.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area