AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

AOL ICQ ActiveX DownloadAgent vulnerability

Added: 12/15/2006 CVE: CVE-2006-5650 BID: 20930 OSVDB: 30220 Background America Online AOL ICQ is a widely used program for communicating with other users on the Internet. Problem The ICQPhone.SipxPhoneManager ActiveX control, which is installed with ICQ, includes a function called DownloadAgent...

AOL CDDBControl ActiveX控件缓冲区溢出漏洞

AOL是一款流行的即时通信软件。 AOL Client Software处理"CDDBControlAOL.CDDBAOLControl" ActiveX控件存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 当"CDDBControlAOL.CDDBAOLControl" ActiveX控件cddbcontrol.dll处理传递个"SetClientInfo"函数方法的"ClientId"参数时缺少正确的边界错误，提交超长字符串可发生基于堆栈的缓冲区溢出，精心构建参数数据可导致以应用程序进程权限执行任意指令。 AOL Client Software 9.0 Securit...

CVE-2006-6442

Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control cddbcontrol.dll, as used in America Online AOL 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary co...

[SA23043] AOL CDDBControl ActiveX Control "SetClientInfo()" Buffer Overflow

TITLE: AOL CDDBControl ActiveX Control "SetClientInfo" Buffer Overflow SECUNIA ADVISORY ID: SA23043 VERIFY ADVISORY: http://secunia.com/advisories/23043/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: AOL 9.x http://secunia.com/product/6840/ AOL 8.x...

Update Protection against AOL Nullsoft Winamp Ultravox Heap Overflow Vulnerability

A heap-based buffer overflow vulnerability was detected in the multimedia player AOL Nullsoft Winamp. A remote attacker can exploit this vulnerability to execute arbitrary code on an affected system...

America Online ICQ ActiveX控件远程代码执行漏洞

ICQ是一款非常流行的即时通讯聊天工具。 ICQ安装的ICQPhone.SipxPhoneManager ActiveX控件实现上存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 ICQ中CLSID为54BDE6EC-F42F-4500-AC46-905177444300的ICQPhone.SipxPhoneManager ActiveX控件的DownloadAgent函数中存在安全漏洞。这个函数取了文件的单个URI参数下载文件并以当前用户的权限执行，因此攻击者可以通过向目标ICQ用户发送消息导致执行任意代码。 AOL ICQ 5.1...

[Full-disclosure] ZDI-06-037: America Online ICQ ActiveX Control Code Execution Vulnerability

ZDI-06-037: America Online ICQ ActiveX Control Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-037.html November 6, 2006 -- CVE ID: CVE-2006-5650 -- Affected Vendor: America Online -- Affected Products: America Online ICQ 5.1 -- TippingPointTM IPS Customer...

CVE-2006-5567

Multiple heap-based buffer overflows in AOL Nullsoft WinAmp before 5.31 allow user-assisted remote attackers to execute arbitrary code via a crafted 1 ultravox-max-msg header to the Ultravox protocol handler or 2 unspecified Lyrics3 tags...

Microsoft Windows畸形ART文件处理堆溢出漏洞（MS06-022）

Microsoft Windows是微软发布的非常流行的操作系统。 Windows处理ART图形的方式存在堆溢出漏洞，攻击者可以通过创建特制的ART图形来利用这个漏洞，如果用户访问了Web站点或特制邮件消息的话就会导致代码执行。成功利用这个漏洞的攻击者可以完全控制受影响的系统。 请注意如果要利用这个漏洞文件扩展名不一定为.art。在Internet Explorer中只要图形是通过HTML文档的IMG SRC标签加载的，则任何扩展名都可被利用。 Microsoft Windows XP SP2 Microsoft Windows XP SP1 Microsoft Windows Serv...

AOL Nullsoft Winamp Lyrics3 heap buffer overflow

Overview AOL Nullsoft Winamp contains a heap-based buffer overflow in the code that handles Lyrics3 tags. This vulnerability may allow a remote, unauthenticated attacker execute arbitrary code on a vulnerable system. Description Lyrics3 is a system for embedding the lyrics inside an MP3 song file...

AOL browser multiple security vulnerabilities

Buffer overflows in different ActiveX controls...

iDefense Security Advisory 10.25.06: AOL YGPPDownload downloadFileDirectory ActiveX Control Heap Corruption Vulnerability

AOL YGPPDownload downloadFileDirectory ActiveX Control Heap Corruption Vulnerability iDefense Security Advisory 10.25.06 http://www.idefense.com/intelligence/vulnerabilities/ Oct 25, 2006 I. BACKGROUND America Online 9.0 Security Edition builds upon Internet Explorer technology to offer its users...

iDefense Security Advisory 10.25.06: AOL YGPPDownload AddPictureNoAlbum ActiveX Control Heap Corruption Vulnerability

AOL YGPPDownload AddPictureNoAlbum ActiveX Control Heap Corruption Vulnerability iDefense Security Advisory 10.25.06 http://www.idefense.com/intelligence/vulnerabilities/ Oct 25, 2006 I. BACKGROUND America Online 9.0 Security Edition builds upon Internet Explorer technology to offer its users...

iDefense Security Advisory 10.25.06: AOL Nullsoft Winamp Ultravox Lyrics3 v2.00 tags Heap Overflow Vulnerability

AOL Nullsoft Winamp Ultravox Lyrics3 v2.00 tags Heap Overflow Vulnerability iDefense Security Advisory 10.25.06 http://www.idefense.com/intelligence/vulnerabilities/ Oct 25, 2006 I. BACKGROUND Lyrics3 is a system for embedding the lyrics inside an MP3 song file. The Winamp media player has suppor...

CVE-2006-5502

Heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control YGPPicDownload.dll 9.2.3.0 in America Online AOL 9.0 Security Edition allows remote attackers to execute arbitrary code via the AddPictureNoAlbum method, a different vulnerability than CVE-2006-5501...

CVE-2006-5502

Heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control YGPPicDownload.dll 9.2.3.0 in America Online AOL 9.0 Security Edition allows remote attackers to execute arbitrary code via the AddPictureNoAlbum method, a different vulnerability than CVE-2006-5501...

CVE-2006-5501

The CVE-2006-5501 entry documents a buffer overflow in AOL.PicDownloadCtrl.1 (YGPPicDownload.dll, v9.2.3.0) used by America Online 9.0 Security Edition. The vulnerability allows remote arbitrary-code execution via the downloadFileDirectory property and is explicitly described as distinct from CVE...

CVE-2006-5501

Buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control YGPPicDownload.dll 9.2.3.0 in America Online AOL 9.0 Security Edition allows remote attackers to execute arbitrary code via the downloadFileDirectory property, a different vulnerability than CVE-2006-5502...

CVE-2006-5502

CVE-2006-5502 refers to a heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 included with AOL 9.0 Security Edition. The vulnerability allows remote attackers to execute arbitrary code via the AddPictureNoAlbum method. Root cause described as a he...