RETIRED: Microsoft November 2012 Advance Notification Multiple Vulnerabilities

Bugtraq ID:	56450
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Nov 08 2012 12:00AM
Updated:	Nov 15 2012 07:50PM
Credit:	Microsoft
Vulnerable:	Microsoft Windows XP Service Pack 3 0 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows Vista Service Pack 2 0 Microsoft Windows Server 2008 R2 Itanium SP1 Microsoft Windows Server 2008 R2 Itanium 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems 0 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for x64-based Systems 0 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for 32-bit Systems 0 Microsoft Office Compatibility Pack SP3 Microsoft Office Compatibility Pack SP2 Microsoft Office 2011 for Mac 0 Microsoft Office 2010 (64-bit edition) SP1 Microsoft Office 2010 (32-bit edition) SP1 Microsoft Office 2008 for Mac 0 Microsoft Office 2007 SP3 Microsoft Office 2007 SP2 Microsoft Office 2003 SP3
Not Vulnerable:

RETIRED: Microsoft November 2012 Advance Notification Multiple Vulnerabilities

Microsoft has released advance notification that on November 13, 2012, they will be releasing six security bulletins addressing nineteen vulnerabilities.

The bulletins and their affected components are as follows:

Four bulletins rated 'Critical' affecting Microsoft Windows, Internet Explorer, and Microsoft .NET Framework
One bulletin rated 'Important' affecting Microsoft Office
One bulletin rated 'Moderate' affecting Microsoft Windows

This BID is being retired. The following individual records exist to better document the issues:

56431 Microsoft Excel CVE-2012-2543 Stack Overflow Remote Code Execution
56430 Microsoft Excel SST Invalid Length Use After Free Remote Code Execution Vulnerability
56426 Microsoft Excel CVE-2012-1886 Memory Corruption Remote Code Execution Vulnerability
56425 Microsoft Excel 'SerAuxErrBar' Heap Overflow Remote Code Execution Vulnerability
56422 Microsoft Internet Explorer CTreeNode Use-After-Free Remote Code Execution Vulnerability
56421 Microsoft Internet Explorer CTreePos Use-After-Free Remote Code Execution Vulnerability
56420 Microsoft Internet Explorer CFormElement Use-After-Free Remote Code Execution Vulnerability
56440 Microsoft IIS FTP Service CVE-2012-2532 Remote Command Injection Vulnerability
56439 Microsoft IIS CVE-2012-2531 Password Information Disclosure Vulnerability
56456 Microsoft .NET Framework CVE-2012-1896 Information Disclosure Vulnerability
56455 Microsoft .NET Framework CVE-2012-1895 Security Bypass Vulnerability
56462 Microsoft .NET Framework CVE-2012-2519 DLL Loading Arbitrary Code Execution Vulnerability
56463 Microsoft .NET Framework CVE-2012-4776 Remote Code Execution Vulnerability
56464 Microsoft .NET Framework CVE-2012-4777 Remote Privilege Escalation Vulnerability
56457 Microsoft Windows Kernel 'Win32k.sys' TrueType Font Parsing Remote Code Execution Vulnerability
56448 Microsoft Windows Kernel 'Win32k.sys' CVE-2012-2553 Local Privilege Escalation Vulnerability
56447 Microsoft Windows Kernel 'Win32k.sys' CVE-2012-2530 Local Privilege Escalation Vulnerability
56424 Microsoft Windows Briefcase CVE-2012-1527 Integer Underflow Remote Code Execution Vulnerability
56442 Microsoft Windows Briefcase CVE-2012-1528 Integer Overflow Remote Code Execution Vulnerability

RETIRED: Microsoft November 2012 Advance Notification Multiple Vulnerabilities

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Microsoft November 2012 Advance Notification Multiple Vulnerabilities

Solution:
Microsoft plans to release fixes to address these issues on November 13, 2012.

Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Microsoft November 2012 Advance Notification Multiple Vulnerabilities

References:

• Microsoft Homepage (Microsoft)