A vulnerability has been reported in Microsoft Visual Basic for Applications (VBA), which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to an error in VBE6.dll within some text parsing code when searching for ActiveX controls in documents supporting VBA (e.g. an Office document). This can be exploited to convert a single byte with the value 0x2E outside the bounds of a buffer to 0x00 via a specially crafted document with embedded ActiveX controls passed to the VBA runtime.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Yu Yang, NSFocus Security Team

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS10-031 (KB974945, KB976321, KB976380, KB976382, KB978213):
http://www.microsoft.com/technet/security/bulletin/ms10-031.mspx

NSFocus:
http://www.nsfocus.com/en/advisories/1002.html

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers