Walied Assar has discovered two vulnerabilities in ResEdit, which can be exploited by malicious people to potentially compromise a user's system.

1) A boundary error when processing resource type in a PE file can be exploited to cause a BSS segment-based buffer overflow via a specially crafted file.

2) A boundary error when processing resource name in a PE file can be exploited to cause a BSS segment-based buffer overflow via a specially crafted file.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

The vulnerabilities are confirmed in version 1.5.11. Other versions may also be affected.

Solution
Do not open files from untrusted sources.

Provided and/or discovered by
Walied Assar

Original Advisory
http://waleedassar.blogspot.com/2012/05/resedit-named-entries-two-buffer.html

Deep Links
Links available to Secunia VIM customers