A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the CRecalcProperty function in mshtml.dll. When rendering HTML after calling the setExpression methods, followed by a modification of the outerHTML property of a programatically created element. The vulnerable code dereferences a previously freed memory location which can be leveraged to execute arbitrary code. Affected versions are 5.01 SP4, 6, and 7.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/61743/ZDI-07-073.txt
Source: https://packetstormsecurity.com/files/61743/Zero-Day-Initiative-Advisory-07-073.html