Microsoft has updated its page on the WMF vulnerability though the best way to describe its stance is like Corporal Jones in Dad's Army: "Don't Panic!". (We'd prefer it to have sounded like Hitchhiker's Guide..)
Microsoft has completed development of the security update for the vulnerability. The security update is now being localized and tested to ensure quality and application compatibility. Microsoft's goal is to release the update on Tuesday, January 10, 2006, as part of its monthly release of security bulletins. This release is predicated on successful completion of quality testing.
So just stay calm.. breathe deeply.. and don't look at any images you shouldn't. Simple, really. Read something really in-depth about it at this Microsoft Security staffer's blog.
Meanwhile the unofficial fix is being used pretty widely by all those who are concerned - though the site is very overloaded.
Ed Bott also has an interesting post showing who did and didn't react quickly to the vulnerability: it's an interesting list. Is your AV vendor there? And in which group?
Update by Jack: there are three links to the unofficial fix on the Ask Jack blog....
