A vulnerability has been discovered in Internet Explorer, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a use-after-free error when composed HTML elements are bound to the same data source. This can be exploited to dereference freed memory via a specially crafted HTML document.

Successful exploitation allows execution of arbitrary code.

NOTE: Reportedly, the vulnerability is currently being actively exploited.

The vulnerability is confirmed in Internet Explorer 7 on a fully patched Windows XP SP3 and in Internet Explorer 6 on a fully patched Windows XP SP2, and reported in Internet Explorer 5.01 SP4. Other versions may also be affected.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported as a 0-day.

Additional information provided by Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS08-078 (KB960714):
http://www.microsoft.com/technet/security/Bulletin/MS08-078.mspx

KnownSec:
http://www.scanw.com/blog/archives/303

Microsoft:
http://www.microsoft.com/technet/security/advisory/961051.mspx

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers