Mediaplayer 7 security flaw
Get your filters out
A security flaw in Media Player 7 lets unauthorised users run arbitrary code on a victim's PC if the latter is viewing a Web site or accessing an HTML email.
The discovery was made by GFI, a developer of email content-checking software. Microsoft has been notified and has issued an advisory which you can view here.
The problem lies in Media Player 7's ability to change interface. GFI says the skinning capabilities which enable it to do this can also be exploited to execute code on remote machines.
All that is required, GFI security engineer Sandro Gauci says, is for an email be opened on a machine which includes Windows Media Player 7 and on which HTML scripts are allowed, or by browsing a malicious site.