Update Available for MSHTML Security Issues in Internet Explorer

An updated version of the "IFRAME ExecCommand" Vulnerability update was posted on November 4, 1999. This update also fixes the MSHTML issues in Microsoft Internet Explorer 5 previously documented in this article as well as the MSHTML issue documented in the following article in the Microsoft Knowledge Base:

NOTE: This problem is resolved in Microsoft Internet Explorer 5.01. For additional information about this issue, please see the following Microsoft Web site: For additional information about the IFRAME ExecCommand" vulnerability, please see the following article in the Microsoft Knowledge Base: Additional information about this issue is available from the following Microsoft Web site: On April 21, 1999, Microsoft released an update to Internet Explorer 4.x and 5 that addresses multiple security vulnerabilities in Internet Explorer's parsing engine, Mshtml.dll. Additional information about these issues is available from the following Microsoft Web site: Updates are available for the following products:

• Microsoft Internet Explorer 4.0, 4.01 for Windows 95 and Windows NT 4.0 (x86 and Alpha)
• Microsoft Windows 98 Internet Explorer 4.01 SP1/SP2)

This update addresses the following three vulnerabilities in Internet Explorer 4.x:

• The IMG SRC tag can point to items other than images, allowing someone to obtain access to information about local files through Internet Explorer's object model.
• A new variant of the "cross-frame" vulnerability that was previously addressed. For additional information about this issue, please see the following article(s) in the Microsoft Knowledge Base:
  168485  (http://support.microsoft.com/kb/168485/EN-US/ ) Update Available for Cross-Frame Security Issue
• A new variant of the previously-addressed "untrusted scripted paste" vulnerability. For additional information about this issue, please see the following article(s) in the Microsoft Knowledge Base:
  169245  (http://support.microsoft.com/kb/169245/EN-US/ ) Update Available for "Untrusted Scripted Paste" Issue

Additionally, This update also fixes the "Untrusted Scripted Paste", "Cross Frame Navigate", and "Frame Spoof" security issues in Microsoft Internet Explorer running on Windows operating systems. For additional information about these issues, please see the following article(s) in the Microsoft Knowledge Base:

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows 95

Update File Name: mshtml4.exe

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows NT 4.0 (x86)

Update File Name: mshtml4.exe

Microsoft Internet Explorer 4.0, 4.01, and 4.01 with Service Pack 1 or 2 for Windows NT 4.0 (Alpha)

Update File Name: mshtml4ax.exe

Windows 98 (Internet Explorer 4.01 SP1/SP2)

Update File Name: mshtml4.exe

Microsoft Internet Explorer 5 for Windows 95, Windows 98, or Windows NT 4.0 (x86)

Update File Name: Mshtml5.exe

Microsoft Internet Explorer 5 for Windows NT 4.0 (Alpha)

Update File Name: Mshtml5ax.exe