Description: This important security update resolves three privately reported vulnerabilities and one publicly disclosed vulnerability. The vulnerability with the most serious security impact could allow remote code execution if a user viewed a specially crafted Web page using Internet Explorer.

Update type: Important

Release date: October 9, 2007

Applies to: All versions

Knowledge base: support.microsoft.com/kb/939653

Download link: 32-bit | 64-bit

Comments: Following is more information on the four vulnerabilities:

• Address Bar Spoofing Vulnerability - CVE-2007-3892
• Error Handling Memory Corruption Vulnerability - CVE-2007-3893
• Address Bar Spoofing Vulnerability - CVE-2007-1091 & CVE-2007-3826

There are a number of possible side effects of this update:

• You may receive an error message that resembles the following when you try to visit a Web page in Windows Internet Explorer 7:
  

  Webpage cannot be displayed

• When you browse from one Web site to a different Web site in Microsoft Internet Explorer 6 in Windows XP, Internet Explorer 6 may crash.
• ActiveX controls that prompt before they are loaded.
• The use of monikers is no longer supported in Internet Explorer.

This update also includes a number of non-security related fixes:

• Internet Explorer 6 may exit with an access violation when the JavaScript garbage collector runs and you have dynamically removed a TBODY, THEAD, or TFOOT HTML tag from a table in Windows XP
• ActiveX controls are inactive when you access a Web page by using Internet Explorer 7
• Windows Internet Explorer 7 does not download an ActiveX control that is referenced in a CODEBASE attribute when you open a Web page that contains the OBJECT element and the CLSID attribute is missing
• You cannot open a Web page by using Windows Internet Explorer 7 if the URL of the Web page contains non-ASCII characters
• Focus is not set to the Web page if you minimize the browser window and then maximize it from the taskbar in Internet Explorer 7
• You cannot log on to an FTP site or you are redirected to the root folder of the FTP site in Internet Explorer 7