Buffer overflow on long font name in header and in OCX MSN Chat Control.
vulners.com/securityvulns/securityvulns:doc:2898
vulners.com/securityvulns/securityvulns:doc:2906
vulners.com/securityvulns/securityvulns:doc:2907