Some vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious people to potentially compromise a vulnerable system.

1) Windows Explorer does not properly free memory when saving Windows Search files. This may be exploited to execute arbitrary code by saving a specially crafted search file using Windows Explorer.

2) Windows Explorer does not properly handle parameters when parsing the search-ms protocol. This can be exploited to execute arbitrary code via a website with a specially crafted call to the search-ms protocol handler.

The vulnerabilities may be exploited to execute arbitrary code by tricking a user into opening and saving a specially crafted saved-search file or visiting a malicious website.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) The vendor credits Andre Protas, eEye Digital Security.
2) The vendor credits Nate McFeters.

Changelog
Further details available in Customer Area

Original Advisory
MS08-075 (KB959349, KB958623, KB958624):
http://www.microsoft.com/technet/security/Bulletin/MS08-075.mspx

Other references
Further details available in Customer Area

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area