Versions 5.5, 6.0

Georgi Guninski reported a security vulnerability in Microsoft's Internet Explorer browser. A remote user can create a web page or HTML-based e-mail message that can access files on another user's PC.

It is reported that there is a bug in GetObject() that allows active scripting to read local files.

The following is an example of code that will trigger the vulnerability:

a=GetObject("http://"+location.host+"/../../../../../../test.txt","htmlfile");

There was no solution available from Microsoft at this time. The author recommends disabling active scripting not using IE in hostile environments.