Two weaknesses have been discovered in Microsoft Internet Explorer, which can be exploited by malicious people to disclose sensitive information.

1) An error when handling cache objects can be exploited to enumerate visited sites.

This weakness is confirmed in Internet Explorer 6, 7, 8, and 9. Other versions may also be affected.

2) The application does not properly handle objects returned by the "getComputedStyle()" function, which can be exploited to enumerate visited sites.

This weakness is confirmed in Internet Explorer 6, 7, and 8. Other versions may also be affected.

Solution
Enable "InPrivate Browsing" when browsing untrusted websites or do not browse untrusted websites.

Provided and/or discovered by
1) Originally discussed by Edward W. Felten and Michael A. Schneider, Princeton University. Additional information and proof provided by Michal Zalewski.
2) Artur Janc and Lukasz Olejnik.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Edward W. Felten and Michael A. Schneider:
http://sip.cs.princeton.edu/pub/webtiming.pdf

Michal Zalewski:
http://lcamtuf.coredump.cx/cachetime/

Artur Janc and Lukasz Olejnik:
http://w2spconf.com/2010/papers/p26.pdf

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers