A pair of newly discovered security flaws in Microsoft's Internet Explorer and Outlook programs could put millions of users at risk of code execution attacks, a private research outfit warned Thursday.

The vulnerabilities were reported to Microsoft Corp. by private research outfit eEye Digital Security, and basic details on the risks and the affected products have been released on eEye's upcoming advisories Web page.

A spokeswoman for the software giant confirmed that engineers at the Microsoft Security Research Center were investigating the eEye discoveries.

"At this time, Microsoft is not aware of any malicious attacks attempting to exploit the reported vulnerabilities, and there is no customer impact based on this issue," she said.

Once the investigation is done, she said Microsoft would "take the appropriate action" to protect affected users.

Under normal circumstances, Microsoft patches are released on a monthly cycle, but in cases of emergency, the company could release an out-of-cycle update.

Since adopting the monthly patching cycle in October 2003, Microsoft has released three out-of-cycle patches, all for "critical" flaws in the Internet Explorer browser.
Full story...


Source : eWeek