Fix typos

Author: wchen-r7

modules/exploits/windows/browser/ms13_058_cflatmarkuppointer.rb

@@ -29,13 +29,13 @@ def initialize(info={})
 				event will be run twice before the crash. The first time is due to the position
 				change of the body element, which is also when a MSHTML!CFlatMarkupPointer::`vftable'
 				object is created during a "SelectAll" command, and this object will be used later
-				on in the crash. The second onmove event seems to be triggered by a InsertButton
+				on for the crash. The second onmove event seems to be triggered by a InsertButton
 				(or Insert-whatever) command, which is also responsible for the free of object
 				CFlatMarkupPointer during page rendering. The EnsureRecalcNotify() function will
 				then still return an invalid reference to CFlatMarkupPointer (stored in EBX), and
 				then passes this on to the next functions (GetLineInfo -> QIClassID).  When this
 				reference arrives in function QIClassID, an access violation finally occurs when
-				the function is trying to call QueryInterface() with the bad eference, an this
+				the function is trying to call QueryInterface() with the bad reference, and this
 				results a crash. Successful control of the freed memory may leverage arbitrary code
 				execution under the context of the user.