Secunia

Description
Two vulnerabilities have been reported in Microsoft Word, which can be exploited by malicious people to compromise a user's system.

1) An error when parsing objects in rich text format (.rtf) files can be exploited to cause a heap-based buffer overflow e.g. when a user opens a specially crafted .rtf file containing malformed strings with Word or previews a specially crafted e-mail containing malformed strings as rich text or HTML.

2) An error exists in the processing of cascading style sheets (CSS) values and can be exploited to corrupt memory when a specially crafted HTML file is opened using Word.

Successful exploitation may allow execution of arbitrary code.

Solution
Apply updates.
Further details available in Customer Area

Provided and/or discovered by
1) wushi, team509 via Zero Day Initiative (ZDI).
2) Jun Mao, iDefense Labs.

Changelog
Further details available in Customer Area

Original Advisory
MS08-026:
http://www.microsoft.com/technet/security/bulletin/ms08-026.mspx

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=700

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-08-023/

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area