An arbitrary code execution vulnerability exists in Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the DirectAnimation.DATuple ActiveX control when improperly calling the Nth() method. By supplying a positive integer we can control a data reference calculation that is later used to control execution. The problem is due to the lack of sanity checking on the index used during a call to TupleNthBvrImpl::GetTypeInfo() in danim.dll.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/49120/TSRT-06-09.txt
Source: https://packetstormsecurity.com/files/49120/TSRT-06-09.txt.html