Microsoft
issued a "critical" security fix for Windows on Tuesday, two weeks before
its scheduled release date. The company is breaking with its monthly patch cycle
to fix a flaw that cybercrooks have been using to attack Windows PCs via
Internet Explorer. Malicious software can be loaded, without the user's
knowledge, onto a vulnerable Windows PC when the user clicks on a malicious link
on a Web site or in an email message. The vulnerability, first reported last
week, lies in a Windows component called "vgx.dll". This component is meant to
support Vector Markup Language documents in the operating system. VML is used
for high-quality vector graphics on the Web and is used for viewing pages in the
IE browser that is part of Windows. Microsoft deems the flaw "critical", its
highest severity rating.
