Unpatched IE Flaw Is Worse Than Expected

It looks like a security hole that was reported many many month ago, but considered minor by Microsoft and therefore never corrected, turns out to be a remote arbitrary code execution flaw. My question is why IE holes go uncorrected for this long – this isn't the first time something like this has happened. One thing I found scary is that a full third of the visitors to the SANS site are vulnerable to the problem. Keep in mind that anyone who has even heard of SANS is more security conscious than the average user, so if that amount of people actually visiting the site are vulnerable..well, the situation is bad. In other news, Firefox 1.5 has been released.
–jeremy
Microsoft, IE, Firefox, SANS