Back on November 8, the second Tuesday of the month, when Microsoft released their Security Bulletins and patches for the month of November, they did not address the iFrame (or HTML Elements) vulnerability which was already being actively exploited by a new variant of the MyDoom worm (later re-dubbed "Bofra" by some antivirus vendors). This week they released a new Security Bulletin out of their normal cycle. The patch is a ranked as Critical by Microsoft and is a cumulative patch for Internet Explorer which also fixes the iFrame vulnerability. For more information see December 2004 Microsoft Security Bulletins