Microsoft Corporation has released a patch to its Internet Explorer Web browser to fix a security issue in the way the browser handles VML (Vector Markup Language) graphics; the patch is available immediately via Microsoft Update, Windows Update, and Window’s Autoupdate feature.
The VML flaw was discovered by Sunbelt Software, and was swiftly finding ground among porn sites; a successful use of the exploit could let an attacker take over a Windows machine. Although Microsoft says the number of attacks launched via the bug was low, the risk the bug posed to customers prompted Microsoft to release the patch “out of band,” two weeks ahead of its normal security update releases. “This one affected many different platforms in many scenarios that are considered by customers to be common usage. While the attacks we saw were very limited, our decision to go out of band on this release was really around the risk in combination with the attacks,” said Microsoft engineers on the company’s security update blog.
Microsoft recommends users undo any previosuly implemented workarounds designed to protect their systems from the VML flaw before applying Microsoft’s update. If users don’t undo changes to their VGX.DLL installation, the update may not install successfully.
