A new variant of the last IE bug is out using Shell.Application instead, once again making code execution possible just by surfing a bad page. This has been out for a couple of days but just now I got to test that it really worked.
Simple test here (executes "cmd.exe /c pause"), worked for me (IE6 fully patched):
http://62.131.86.111/security/idiots.../installer.htm
No patch from microsoft out yet but EEYE wipped something up that should fix it:
http://www.eeye.com/html/research/al...L20040610.html