When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Internet Explorer Cumulative Update MS04-040 (KB889669)

Neowin · Dec 2, 2004 15:41 EST with -1 comments

Microsoft has issued a patch, out of its normal security patch cycle, for a critical bug in Internet Explorer versions from 6.0 up to but not including Windows XP Service Pack 2 (SP2).

According to the advisory issued by Microsoft, the bug could allow remote code execution on an affected system. The vulnerability is a buffer overflow in the handling of IFRAME and EMBED tags. By providing oversized source fields for those tags, an attacker could potentially execute arbitrary code on the user's system. The vulnerability's severity is underscored by the fact that this is only the second time that Microsoft has issued an out-of-cycle security patch since it instituted its monthly patch cycles in November 2003.

Note: Users of Windows XP SP2 and IE 5.x are NOT affected by this vulnerability.