Description: This security update resolves five privately reported vulnerabilities and one publicly disclosed vulnerability. All of the vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The security update addresses these vulnerabilities by modifying the way that Internet Explorer handles the error resulting in the exploitable condition.

Update type: Critical

Release date: August 12, 2008

Applies to: All

Knowledge base: support.microsoft.com/kb/953838

Download link: 32-bit | 64-bit

Comments: Here are the specifics on the vulnerabilities covered by this update:

• HTML Objects Memory Corruption Vulnerability – CVE-2008-2254
• HTML Objects Memory Corruption Vulnerability – CVE-2008-2255
• Uninitialized Memory Corruption Vulnerability – CVE-2008-2256
• HTML Objects Memory Corruption Vulnerability – CVE-2008-2257 and CVE-2008-2258
• HTML Component Handling Vulnerability – CVE-2008-2259