CVE-2007-4901

The embedded Internet Explorer server control in AOL Instant Messenger AIM 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected...

CVE-2007-4901

Affected software: AOL Instant Messenger (AIM) family on Windows (AIM 6.1.41.2, 6.2.32.1; AIM Pro; AIM Lite). Component/causal issue: embedded Internet Explorer server control (mshtml.dll) used to render HTML in instant messages, with insufficient input sanitization of inbound HTML content. Impac...

AOL Instant Messenger <= 6.1.41.2 Control Notification Window Script Injection

Binary data 4215.prm...

AOL Instant Messenger alerts spoofing

No description provided...

AIM Arbitrary HTML Display in Notification Window

Arbitrary HTML can be readily displayed in notification windows generated by AOL Instant Messenger when the window of origin is not the main focus. This vulnerability is known to be present at least in version 6.1.41.2 which is the current release. It appears to display any form of HTML-compliant...

Buffer overflow

Buffer overflow in the AOL Instant Messenger AIM protocol handler in AIM.DLL in Cerulean Studios Trillian allows remote attackers to execute arbitrary code via a malformed aim: URI, as demonstrated by a long URI beginning with the aim:///1111111/ substring...

CVE-2007-3832

The CVE-2007-3832 issue affects Trillian before 3.1.7.0, where a buffer overflow in the AIM protocol URI handler (aim.dll) can be triggered by specially crafted aim:// URIs. An unauthenticated remote attacker could potentially execute arbitrary code with the user’s privileges by convincing a user...

Code injection

AOL Instant Messenger AIM 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service application crash via a malformed header value in a SIP INVITE message, a different vulnerability than CVE-2007-3350...

CVE-2007-3437

AOL Instant Messenger AIM 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service application crash via a malformed header value in a SIP INVITE message, a different vulnerability than CVE-2007-3350...

CVE-2007-3437

AOL Instant Messenger AIM 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service application crash via a malformed header value in a SIP INVITE message, a different vulnerability than CVE-2007-3350...

CVE-2007-3437

CVE-2007-3437 affects AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP. It is a remote denial of service vulnerability triggered by a malformed SIP INVITE header value, causing the AIM application to crash. The vulnerability is described as distinct from CVE-2007-3350 (a separate SIP INVITE flo...

Design/Logic Flaw

AOL Instant Messenger AIM 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service application hang via a flood of spoofed SIP INVITE requests...

CVE-2007-3350

CVE-2007-3350 affects AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP. The vulnerability allows remote attackers to cause a denial of service (application hang) by sending a flood of spoofed SIP INVITE requests. The public records note the issue as a DoS vector in SIP INVITE handling, with no ...

CVE-2007-3350

AOL Instant Messenger AIM 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service application hang via a flood of spoofed SIP INVITE requests...

AOL Instant Messenger <= 6.1.32.1 SIP INVITE Message DoS

Binary data 4103.prm...

AOL Instant Messenger 6 Version Detection

Binary data 4104.prm...

AOL Instant Messenger User Enumeration (deprecated)

Binary data 4082.prm...

[Full-disclosure] New Vulnerability against Firefox/ Major Extensions

This information also posted with html link goodness to http://paranoia.dubfire.net/2007/05/remote-vulnerability-in-firefox.html -------------------------- Executive Summary -------------------------- A vulnerability exists in the upgrade mechanism used by a number of high profile Firefox...

Memory corruption

The Impulse Tracker IT and ScreamTracker 3 S3M modules in INMOD.DLL in AOL Nullsoft Winamp 5.33 allows remote attackers to execute arbitrary code via a crafted 1 .IT or 2 .S3M file containing integer values that are used as memory offsets, which triggers memory corruption...

Memory corruption

LIBSNDFILE.DLL, as used by AOL Nullsoft Winamp 5.33 and possibly other products, allows remote attackers to execute arbitrary code via a crafted .MAT file that contains a value that is used as an offset, which triggers memory corruption...