For more complete information, refer to the Microsoft Security Bulletin Summary for January 2006.
Microsoft has released updates that address critical vulnerabilities in Windows, Outlook, and Exchange. Exploitation of these vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service on a vulnerable system.
A heap-based buffer overflow in the way Microsoft Windows processes embedded web fonts may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Microsoft Outlook and Microsoft Exchange contain an unspecified vulnerability in processing TNEF attachments. This may allow a remote, unauthenticated attacker to execute arbitrary code on a system running the vulnerable software.
Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user. If the user is logged on with administrative privileges, the attacker could take complete control of an affected system. An attacker may also be able to cause a denial of service.
Please see the following US-CERT Vulnerability Notes for workarounds.