The first vulnerability is a buffer overrun caused by IE's failure to properly determine an object type returned from a Web server.
Microsoft said a buffer overrun vulnerability occurs because IE does not properly determine an object type returned from a Web server.