Multiple vulnerabilities have been reported in Microsoft Lync and Office Communicator, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system.

1) An error exists when parsing TrueType fonts.

For more information:
SA46724

2) An error exists in the t2embed.dll module when parsing TrueType fonts.

For more information:
SA49120 (#2)

3) The client loads libraries (e.g. wlanapi.dll and ncrypt.dll) in an insecure manner, which can be exploited to load arbitrary libraries by tricking a user into e.g. opening a ".ocsmeet" file located on a remote WebDAV or SMB share.

Successful exploitation of this vulnerability allows execution of arbitrary code.

4) An unspecified error in the "SafeHTML" API when sanitising HTML code can be exploited to execute arbitrary HTML and script code in the user's chat session.

This is related to vulnerability #2 in:
SA49412

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
3) hamburgers maccoy via Secunia
4) Adi Cohen, IBM Application Security Research

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS12-039 (KB2707956, KB2708980, KB2693282, KB2696031, KB2693283, KB2702444):
http://technet.microsoft.com/en-us/security/bulletin/ms12-039

IBM Application Security Research:
http://blog.watchfire.com/wfblog/2012/07/tostatichtml-the-second-encounter-cve-2012-1858-html-sanitizing-information-disclosure-introduction-t.html

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers