CERT:
http://www.kb.cert.org/vuls/id/181038

NIST
http://www.nist.org/nist_plugins/content/content.php?content.25

Other advisories have been published containing similar information.

Lotus Notes accesses shimgvw.dll under the following circumstances:

• When opening (launching) an image file attachment
• When double clicking on (activating) an OLE object that uses the image viewer control
• When the form is set to auto-launch first OLE object and the object uses the image control. In received emails, you have to say "Yes" to launch it before it will activate the object
• When creating an OLE object that uses the image control
• When browsing for a file in a folder (which is set to display thumbnails) that contains any image file

• Microsoft's Security Advisory # 912480 (http://www.microsoft.com/technet/security/advisory/912840.mspx), and
• Security Bulletin # MS06-001 "Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919)"(http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx), which contains download links for a security update.

Lotus Notes does not access shimgvw.dll under the following circumstances:

• When opening, previewing or reading an email with images in it
• When opening, previewing or reading an email that has an OLE object that uses the image control. (Notes displays the image of the object but does not run the object unless the user takes action to activate it.)
• When using the native Notes browser/HTML rendering engine
• When browsing for a file in a folder that does not have image files