Microsoft Warns of Zero Day Bug Affecting Internet Explorer 6-8
How it works is IE attempts to reference and use an object that had previously been freed. The components of an exploit for such a vulnerability are typically:
- Heap spray or similar memory preparation to ensure the memory being accessed after it has been freed is useful
- A way around the ASLR platform-level mitigation
- A way around the DEP platform-level mitigation
Microsoft suggests disabling certain services while it works on a patch. Alternately, you can use an different browser like Google Chrome
"The IE team is working around the clock to develop a security update to address this vulnerability for earlier versions of the product," Microsoft stated. " However, until the update is available, customers using Internet Explorer 8 can block the current targeted attacks by introducing changes to disrupt any of the elements of the exploit."
The vulnerability is not present in IE9 or IE10.