Microsoft issued an emergency fix for a zero-day IE bug that allows for remote code execution. Researchers found they could bypass the fix-it Microsoft issued last week in response to active “watering-hole” attacks exploiting IE 8. Microsoft is aware of the researchers’ findings, but it is still recommending that users apply the fix. IE 9 and IE 10 don’t include the bug, which some researchers say is a “use-after-free” vulnerability. “This seems like a bad fix,” says Veracode’s Chris Wysopal, CTO.”]
Source: https://www.darkreading.com/attacks-breaches/when-the-fix-it-doesn-t-fix-it