Some vulnerabilities have been reported in Microsoft Office Web Components, which can be exploited by malicious people to compromise a user's system.

1) An error in the OWC10.Spreadsheet ActiveX control can be exploited to corrupt memory via specially crafted parameters passed to the "msDataSourceObject()" method.

NOTE: According to Microsoft, the vulnerability is currently being actively exploited.

2) An error when loading and unloading the OWC10 ActiveX control can be exploited to corrupt memory.

3) An error in the OWC10.Spreadsheet ActiveX control related to the "BorderAround()" method can be exploited to corrupt heap memory by accessing certain methods in a specific order.

4) A boundary error in the Office Web Components ActiveX control can be exploited to cause a stack-based buffer overflow by passing an overly long parameter used for referencing an Excel file to load.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Reported as a 0-day.
* Peter Vreugdenhil, reported via ZDI
* The vendor also credits Haifei Li of Fortinet’s FortiGuard Global Security Research Team.
2, 3) Peter Vreugdenhil, reported via ZDI
4) Sean Larsson, iDefense Labs.

Changelog
Further details available in Customer Area

Original Advisory
Microsoft:
http://www.microsoft.com/technet/security/advisory/973472.mspx
http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspx
http://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspx

MS09-043 (KB957638, KB947320, KB947319, KB947318, KB947826, KB971388, KB969172, KB968377):
http://www.microsoft.com/technet/security/Bulletin/MS09-043.mspx

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-054/
http://www.zerodayinitiative.com/advisories/ZDI-09-055/
http://www.zerodayinitiative.com/advisories/ZDI-09-056/

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=819

Other references
Further details available in Customer Area

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area