Multiple vulnerabilities have been reported in Microsoft PowerPoint, which can be exploited by malicious people to compromise a user's system.

1) Two boundary errors when processing certain atoms can be exploited to cause stack-based buffer overflows via a specially crafted PowerPoint file.

2) An error when parsing paragraph formatting data can be exploited to corrupt memory via a specially crafted PowerPoint 4.0 file.

3) An integer overflow error when allocating space for a number of records of a specific type can be exploited to cause a heap-based buffer overflow via a specially crafted PowerPoint file.

4) An error when parsing BuildList records can be exploited to corrupt memory via a specially crafted PowerPoint file containing multiple BuildList records with ChartBuild containers inside.

5) An error when parsing certain malformed structure values inside a Notes container can be exploited to corrupt memory via a specially crafted PowerPoint file.

6) Multiple errors when parsing sound data can be exploited to cause stack-based buffer overflows or corrupt heap memory via specially crafted PowerPoint 4.0 and 95 files.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Carsten Eiram, Secunia Research.
2) The vendor credits an anonymous person via VeriSign iDefense Labs.
3) Sean Larsson, VeriSign iDefense Labs.
4) Sean Larsson, VeriSign iDefense Labs.
5) Ling and Wushi via ZDI and Sean Larsson, VeriSign iDefense Labs.
6) The vendor credits:
* Marsu via iDefense.
* Nicolas Joly, Vupen.
* An anonymous person via VeriSign iDefense Labs.

Changelog
Further details available in Customer Area

Original Advisory
MS09-017 (KB957781, KB957784, KB957789, KB957790, KB967340, KB969615, KB969618, KB970059, KB969661, KB971822, KB971824, KB967043, KB967044):
http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx

Secunia Research:
http://secunia.com/secunia_research/2008-46/

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=796
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=795
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=794
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=793
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=792
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=791
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=790
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=789
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=788
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=787

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-020/

Deep Links
Links available in Customer Area