An IE bug rises again after two years
According to security researchers, recent updates to IE contain a serious fallback that
leaves systems once more vulnerable to a flaw that was fixed more than two years ago. This vulnerability, which involves how IE processes XML files, gives rise to information disclosure risks. The security bug was patched and closed back in Aug 2002, six months after Microsoft was initially notified about it by an Israeli firm. Microsoft rated the vulnerability as "moderate" when it fixed the flaw as part a cumulative update (MS02-047) to IE issued on August 22 2002.
That should have been the end of it but the bug resurfaced again late last week, when veteran browser bug hunter Georgi Guninski retested the issue and found the patch is no longer applicable. Now IE is vulnerable despite a cumulative fix issued earlier this week along with nine other security updates in the latest monthly patch batch from Microsoft.
