IE6 and 7 hit by zero-day bug

A zero-day exploit that targets a vulnerability in Internet Explorer 6 and 7 has been published.

The exploit code, which was posted on the BugTraq mailing-list on Friday, is not yet reliable, according to a Symantec blog post on Saturday. However, the security vendor warned in its post that it expected a fully functioning exploit in the wild "in the near future".

According to Vupen Security, the exploit targets a memory corruption error in Microsoft HTML viewer, which occurs when Internet Explorer retrieves certain cascading style sheet (CSS) objects. Vupen warned that this flaw could allow an attacker to crash the browser, or to trick a user into visiting a malicious web page.

Read the full story on ZDNet UK.