[Full-disclosure] New CVE number states Excel Style handling as a separate issue

[Juha-Matti Laurio <juha-matti.laurio@xxxxxxxx>]

New CVE
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3431

published recently confirms the information that Microsoft Excel Style handling 
vulnerability aka Nanika.xls issue is a separate vulnerability.
This vulnerability mentioned affects only to Simplified Chinese, Traditional 
Chinese, Japanese and Korean versions of Excel.

This vulnerability (let's say 4th Excel vulnerability) uses Repair Mode too and 
user interaction is needed.
This information has been updated to my First Microsoft Excel 0-day 
Vulnerability FAQ document at SecuriTeam Blogs.

If fix to this vulnerability is included to monthly July updates from Microsoft 
it's expected that this CVE-2006-3431
is listed in the upcoming security bulletin to clarify the situation.

So-called 1st Excel code execution vulnerability reported in June is
http://www.microsoft.com/technet/security/advisory/921365.mspx
and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3059

- Juha-Matti

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/