Description: This security update resolves a privately reported vulnerability in the JScript scripting engine that could allow remote code execution if a user opened a specially crafted file or visited a specially crafted Web site and invoked a malformed script. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update addresses the vulnerability by modifying the way that the JScript engine processes scripts in Web pages. Keep reading →

Consider the following scenario. You take the following actions on a computer that is running Microsoft Windows XP or Microsoft Windows Server 2003:

1. You install the 2007 time zone update for Microsoft Windows operating systems that is documented in the following Microsoft Knowledge Base article:
   928388 2007 time zone update for Microsoft Windows operating systems
2. You install the C run-time (CRT) update that is documented in the following Microsoft Knowledge Base article:
   932590 FIX: Windows-based applications that use the TZ environment variable may not work as expected because of changes to DST
3. You set the TZ environment variable.

In this scenario, when you create a custom application that uses the JScript version 5.7 Date object, the time is reported incorrectly for dates that are between the second Sunday in March and the first Sunday in April for the year 2007. Instead of the time being reported in daylight saving time, the time is reported in standard time. For example, for March 30, 2007, the JScript Date object reports time in standard time instead of in daylight saving time.

Note: JScript version 5.7 is included with Windows Vista. Additionally, when you install Internet Explorer 7 on a computer that is running Windows XP with Service Pack 2 (SP2), Windows XP Professional x64 Edition, or Windows Server 2003 SP1, JScript version 5.7 is installed.