This update resolves a newly-discovered public vulnerability and other
privately-reported variations of the same vulnerability. The Microsoft DDS
Library Shape Control (Msdds.dll) and other COM objects could, when
instantiated in Internet Explorer, allow an attacker to take complete control
of an affected system. Because these COM objects were not designed to be
instantiated in Internet Explorer, this update sets the kill bit for the affected
Class Identifiers (CLSID) in these COM objects.

If a user is logged on with administrative user rights, an attacker who
successfully exploited this vulnerability could take complete control of an
affected system. An attacker could then install programs; view, change, or
delete data; or create new accounts with full user rights. Users whose
accounts are configured to have fewer user rights on the system could be
less impacted than users who operate with administrative user rights.