AOL Instant Messenger vulnerable to buffer overflow via numerous fonts sent to client followed by &lt HR&gt

ID VU:530299
Type cert
Reporter CERT
Modified 2002-01-14T18:28:00



AOL Instant Messenger (AIM) is an application that allows one peer to communicate with another. A vulnerability exists that can crash the client window and in some cases the operating system(OS).


AIM for Windows stores font names in the messages sent from one client to another. By using numerous fonts, and sending a html division line <HR>, an attacker can cause the victim's client to crash.


By repeatedly sending this message, a continued denial of service can be caused.


This has been resolved in AIM for Windows beta version 4.8.2540.

AIM permits the user to only accept messages from known/trusted peers. Enable this feature.

Vendor Information


Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

AOL Time Warner __ Affected

Notified: October 17, 2001 Updated: January 14, 2002



Vendor Statement

This is fixed in our most recent Win AIM Beta 4.8.2540 posted Nov. 19th.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Win AIM Beta 4.8.2540 was posted on Nov. 19th, 2001.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
Base | |
Temporal | |
Environmental | |


  • <>
  • <>


This vulnerability was discovered by Robbie Saunders.

This document was written by Jason Rafail.

Other Information

CVE IDs: | None
Severity Metric: | 9.45
Date Public: | 2001-10-06
Date First Published: | 2002-01-14
Date Last Updated: | 2002-01-14 18:28 UTC
Document Revision: | 12