eEye Digital Security has reported a vulnerability in Microsoft Office Publisher 2007, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the Publisher conversion library used for converting old Publisher formats (PUBCONV.DLL) calling a user-controlled function pointer. This can be exploited by tricking a user into viewing a specially crafted Publisher 98 legacy file containing an embedded textbox object.

Successful exploitation allows execution of arbitrary code.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Greg Linares, eEye Digital Security.

Changelog
Further details available in Customer Area

Original Advisory
MS07-037 (KB936548):
http://www.microsoft.com/technet/security/Bulletin/MS07-037.mspx

eEye Digital Security:
http://research.eeye.com/html/advisories/published/AD20070710.html

Deep Links
Links available in Customer Area