mailing list archives
Re: Microsoft Office Publisher 2010 memory corruption
From: Peter Ferrie <peter.ferrie () gmail com>
Date: Sun, 28 Oct 2012 18:48:23 -0700
I have discovered many crashes during testing MS product which i can
discuss with authority responsible
memory corruption during the handling of the pub files a
context-dependent attacker can execute arbitrary code.
ecx=00000004 ... esi=00000000
7855b450 8b448ef0 mov eax,dword ptr [esi+ecx*4-10h]
This is a null pointer access. You have not demonstrated any control
over the value in esi, so it is highly unlikely that it can be used
We will investigate it, of course.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/