Secunia

Two vulnerabilities have been reported in Microsoft Windows and Microsoft Office, which can be exploited by malicious people to compromise a user's system.

1) An integer overflow error exists in Wordpad and Office text converters when parsing the "DocumentSummaryInformation" stream inside a Word 97 document. This can be exploited to cause a heap-based buffer overflow by tricking a user into opening a file with a specially crafted value specifying the number of property names present.

2) A second integer overflow error exists in Wordpad and Office text converters when parsing certain information inside a Word 97 document. This can be exploited to cause a heap-based buffer overflow by tricking a user into opening a specially crafted file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) Jun Mao and Sean Larsson, iDefense Labs.
2) Silent fix noticed by Secunia Research during analysis of released patches.

Changelog
Further details available in Customer Area

Original Advisory
MS09-073 (KB973904, KB974882, KB975008, KB975051, KB975539):
http://www.microsoft.com/technet/security/Bulletin/MS09-073.mspx

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=834

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area