Windows users are currently vulnerable to files downloaded from dodgy websites that exploit a hole in Microsoft's Windows Metafile (WMF) format for which there is no patch. IE executes WMF files automatically. However, users of other browsers still get infected if they are asked if they want to display the file, say yes, and the browser invokes the Windows Picture and Fax Viewer.
I've posted more about this -- including the workaround -- on the Ask Jack blog, based on information from the F-Secure security blog.
