The systems most at risk to exploits are workstations and servers that allow users to visit untrusted, external websites. Systems that restrict user privileges may hold lower risk than those that grant users administrative privileges. Any code execution as a result of successful exploit attempts would run with privileges of the user who launched the affected application.
Attacks originating from the Internet security zone are unlikely to target systems with the MS05-052 update because the update added additional checks before loading COM objects.
Microsoft also disabled a number of additional ActiveX objects that are not affected by the memory corruption vulnerability but were not designed to be instantiated within Internet Explorer.
Installation of this patch will set the killbits for these objects.
The update from Microsoft prevents Internet Explorer from loading the vulnerable COM objects as ActiveX controls.
Patches initially released with MS06-042 caused an error when installed on Windows XP SP1 or Windows 2000 SP4 systems. Internet Explorer 6.0 SP1 may unexpectedly exit when configured to use the HTTP 1.1 protocol if it is used to visit a website that presents data using compression. However, Microsoft has released updated patches for MS06-042 to address this issue.