Jesper Johansson

Name of the Vulnerable Software and Affected Versions: Windows XP and Server 2003 with Internet Explorer 7 installed Description: The issue concerns the Windows shell's handling of URIs, specifically the URL handling in Shell32.dll, which allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler. This could potentially be exploited by including a specially crafted URI in an application or attachment, allowing for remote code execution. The issue might be related to other problems involving URL handlers in Windows systems and could also involve separate issues in applications invoked by the handlers. Recommendations: For Windows XP and Server 2003 with Internet Explorer 7 installed, consider restricting the use of URI handlers to minimize the risk of exploitation until a fix is available. Avoid using applications that invoke URI handlers with untrusted input. As a temporary workaround, consider disabling the handling of mailto: and other URI handlers in the Windows shell until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer (affected versions not specified) **Description** The issue allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a `FirefoxURL` or `FirefoxHTML` URI. This occurs when Internet Explorer invokes firefox.exe and fails to properly delimit the URL argument, potentially affecting other protocol handlers in Internet Explorer as well. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.