IE flaws used to spread pop-up toolbar

One flaw lets an attacker run a program on a victim’s machine, while the other enables malicious code to “cross zones,” or run with privileges higher than normal. Together, the two issues allow for the creation of a Web site that, when visited by victims, can upload and install programs to the victim’s computer, according to two analyses of the security holes.