Such a program would be capable of taking any action that the user himself could take on his machine, including adding, changing or deleting data, communicating with web sites, or reformatting the hard drive. In order for the attacker to successfully attack the user via this vulnerability, she would need to be able to persuade the user to either browse to a web site she controlled or open an HTML e-mail that she had sent. If an HTML mail contains an executable attachment whose MIME type is incorrectly given as one of several unusual types, a flaw in IE will cause the attachment to be executed without displaying a warning dialogue. I thought mail programs like Outlook and Outlook Express were in charge of displaying mails. In general, they are.
Mail clients handle creating, sending, receiving and displaying e-mail.
There is one exception, however they rely on IE to perform a process called rendering if the mail is an HTML mail. Rendering is the process of processing and displaying a web page. HTML mails are rendered by IE because they are essentially web pages sent as mails. The flaw in this case involves how IE renders HTML mails. If a mail contains an attachment, IE should provide the ability to open the attachment when it renders the message.