Secunia

Multiple vulnerabilities have been reported in various Windows components, which can be exploited by malicious people to bypass security features or compromise a user's system.

1) An error in the Microsoft ATL (Active Template Library) "CComVariant::ReadFromStream()" function used in the ATL headers can be exploited to read data from a stream directly onto the stack, causing a buffer overflow.

For more information see vulnerability #1:
SA35683

2) A boundary error in the Microsoft ATL Load method of the IPersistStreamInit interface can be exploited to cause a buffer overflow.

For more information see vulnerability #2:
SA35683

3) An error in the Microsoft ATL headers may result in VariantClear() being called on a VARIANT that has not been correctly initialised.

For more information see vulnerability #1:
SA35967

4) An error in the ATL headers when handling object instantiation from data streams may allow bypassing of security policies such as kill-bits in Internet Explorer.

For more information see vulnerability #2:
SA35967

5) An error in the ATL headers due to insufficient validation of a VARIANT read from a stream could result in unintended memory being freed when deleting the VARIANT. This can be exploited to corrupt memory when a user e.g. views a specially crafted web page.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Originally reported in Microsoft Video ActiveX Control by Ryan Smith and Alex Wheeler, IBM ISS X-Force.
2) Robert Freeman, IBM ISS X-Force.
3) David Dewey, IBM ISS X-Force.
4) Ryan Smith, VeriSign iDefense Labs.
5) Ryan Smith, VeriSign iDefense Labs.

Changelog
Further details available in Customer Area

Original Advisory
MS09-037 (KB973354, KB973507, KB973540, KB973815, KB973869, KB973908):
http://www.microsoft.com/technet/security/Bulletin/MS09-037.mspx

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=822

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area