Another Malformed String Exploit Plagues Excel
632428
This morning, Microsoft acknowledged the discovery of a new and active exploit involving Excel. Although the company says the attacks it has seen thus far appear limited and targeted, itâs repeating its warning to users not to open spreadsheets sent in e-mails from untrusted users.
697888
"Extremely critical flaw" in Microsoft Word 2000, which has no released patch, could lead to remote execution of code.
414849
The giant has released a patch so that Windows doesn&#39;t let in hackers when it handles JPEG graphics formats. The flaw means that attackers can create an image file that will automatically run dodgy code, dump
313451
PDF attack prompts round-the-clock patch fest Escalating attacks exploiting a serious weakness in PDF files have prompted Microsoft to issue an all-hands-on-deck call to fix a vulnerability that lurks in the bowels of Windows XP.â¦
632254
Harry Fuecks has gotten busy and posted the third part of his "Joy of Regular Expressions" series over on the SitePoint PHP Blog today.   Following on from the last part, this one is more of an intermission-a round up of regex syntax seen so far and a couple of links following feedback.   He looks at two different topics:  A "must reads" section of resources for getting the most out of regular expressions A comprehensive "cheat sheet" with tips on expression delimiters, literals, pattern modifiers, character classes, quantifiers, assertions, sub-patterns, and working with the blackslash.
764199
Danne Lundqvist has posted about the process he went through when developing a solution to create Excel files in PHP:   I'm on this project at work where we need to create an excel file and send it via email or ftp to a recipient. The normal answer to this is to create a comma separated file and name it .xls and excel will work it out. However, that only works if you open it directly through an http request and are able to set the http headers correctly.   To get around these limitations, he found two solutions (thanks Google!) in PEAR's Spreadsheet_Excel_Writer and an MS-Excel Stream Handler class. He includes code that gives an example of another solution, one that packs data into a binary string and returns it as a part of the Excel document.
598275
InfoWorld - When a hacker going by the name Chujwamwdupe published attack code that exploited a recently patched bug in Microsoft Office 2003 earlier this week, it looked almost as if he were publishing the software out of spite.
205196
A math problem in Excel 2007 crops up when presenting data, not when processing it, Microsoft says.
699435
A researcher has posted proof-of-concept code for a zero-day flaw within Mac OS X dealing with its handling of disk image (.dmg) files. The issue causes a memory corruption vulnerability that could allow attackers to execute arbitrary code.
421564
65,535 = the Number of the Beast A Microsoft manager has confirmed the existence of a serious bug that could give programmers and number crunchers a failing grade when relying on the latest version of Excel to do basic arithmetic.â¦
728050
According to this security release from Secunia, there's a cross-site scripting vulnerability with the Travelsized CMS package (PHP-based) in the main index file.   David Vieira-Kurz has discovered some vulnerabilities in Travelsized CMS, which can be exploited by malicious people to conduct cross-site scripting attacks.   The problem comes from the input parameters "page" and "langauge" not being verified and sanitized. Users are encouraged to go in and manually edit the source to correct the problem as there is no patch currently posted as of yet. You can get complete information about this issue from the full Secunia report.
308058
For the third time this week, hackers have released attack code that exploits a critical vulnerability in Microsoft Word. The proof-of-concept code, which addresses a previously unknown Word vulnerability, was posted Tuesday.
469846
An exploit for PHP's COM objects on the 5.x series has been reported by shinnai - an issue that allows for a bypass of safe_mode and disable_function settings.   The exploit has been published as a PHP file for easy testing on your Windows/PHP installation (it was tested on WinXP Pro SP2 on both the CLI and Apache). No additional modules are needed for this exploit - only the COM functions and a Windows system.   The issue comes from an overflow in the str_repeat function allowing for the execution of whatever applications the developer wants on the remote Windows machine (including the ability to create and remove files and directories). There is no path for this issue currently (should be corrected in the next minor PHP release).
607068
As per suggestions contained in the FAQ: Herein lies a report of two identified and as-of-yet uncorrected security flaws in Scoop. &nbsp;Enough detail will be provided to assist admins in investigating and correcting the flaws, but it is the author's hope that the details of the flaws will be sufficiently obscured to prevent abuse by the undesirables. Executive summary: Through the exploitation of various unchecked privileged operations, attackers may be able to perform admin-level actions leading to data loss. &nbsp;Additionally, well-intentioned security measures combined with XSS vulnerabilities can be exercised to simulate admin-level action, resulting in data loss.
242266
Avoiding errors In a recent article here in The Register we saw some of the problems that result when floating point numbers are misused or chosen inappropriately.â¦
219303
Microsoft is warning of a new unpatched vulnerability in its Word software.
403071
Here's a screen shot of the HTML source.  Looks like it's trying to serve some kind of ActiveX control. Happy to be using a Mac.  PS: Scoble just showed up and TM works on his cell phone so there's something weird going on.