Update: US-CERT Records Internet Explorer Security Advisory

Microsoft's security advisory was recorded with US-CERT as VU#493881 on December 11. Vulnerability was found in IE 7, but IE 5.01 SP4, IE 6 and IE 8 Beta2 are also potentially affected. The Vulnerability Note includes a number of possible workarounds.

The actual Security Advisory 961051 from Microsoft also includes the so-called Disable XML Island and Disable Row Position functionality workarounds. The problem came about through an error in the browser's XML parser that can cause IE to exit unexpectedly in a state that is exploitable from a specially prepared website. IE users affected by the bug will need to wait until the next monthly security update from Microsoft.

Update: Microsoft has since released a Security Bulletin Summary so that users don't need to wait until the next monthly update In January. The bulletin with the out-of-band patch covers two security issues, including the XML parser bug described in this article. Microsoft, in their usual fashion, accompanied the to-do with webcasts and advance notification.