Another day, another load of security issues with Internet Explorer. IE vulnerabilities are sometimes overblown as they require such rare specific circumstances to be "activated" they become pretty much harmless. This one, however, seems to be quite a serious vulnerability as it can install code on your computer without any user interaction - just a visit to a dodgy webpage is needed.


Some vulnerabilities have been discovered in Internet Explorer, which can be exploited by malicious people to compromise a user's system, conduct cross-site/zone scripting and bypass a security feature in Microsoft Windows XP SP2.

1) Insufficient validation of drag and drop events from the "Internet" zone to local resources for valid images or media files with embedded HTML code. This can be exploited by e.g. a malicious web site to plant arbitrary HTML documents on a user's system, which may allow execution of arbitrary script code in the "Local Computer" zone.

Secunia