Microsoft Internet Explorer contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when a user retrieves a malicious web page that contains specially crafted JavaScript that triggers certain errors simultaneously, which leads to memory corruption due to an error within the exception handling of script errors. It is possible that the flaw may allow an attacker to execute arbitrary code resulting in a loss of integrity.

Microsoft has released a patch to address this issue. Additionally, it is possible to correct the flaw by implementing the following workaround(s): Disable scripting.

• Security Tracker: 1017373
• CVE ID: 2006-5579 (see also: NVD)
• Secunia Advisory ID: 20807
• Bugtraq ID: 21552
• SCIP VulDB ID: 2733
• Related OSVDB ID: 30814 30815 30816
• CERT VU: 599832
• Microsoft Knowledge Base Article: 925454
• VUPEN Advisory: ADV-2006-4966 [ Link is 404 ]
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-12/0211.html
• Other Advisory URL: http://secunia.com/secunia_research/2006-58/advisory/
  http://www.eeye.com/research/html/newsletters/alert/pub/AL20061212.html [ Link is 404 ]
  http://www.symantec.com/enterprise/security_response/weblog/2006/12/microsoft_patch_tuesday_decemb.html
• Microsoft Security Bulletin: MS06-072

• Jakob Balle - Secunia Research
• Carsten Eiram - Secunia Research