ICQ Pro 2003b远程堆溢出漏洞

ICQ是一款流行的即时通讯聊天工具。 ICQ Pro 2003b build 3916客户端处理特定类型消息的长度时存在堆溢出漏洞，可能导致拒绝服务或远程执行任意代码 受影响系统： AOL ICQ Pro 2003b 不受影响系统： AOL ICQ 5.1 厂商补丁： AOL --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.icq.com/...

ICQ Toolbar 1.3 for IE多个安全漏洞

ICQ Toolbar是一个可安装于IE的工具栏，通过HTML页面提供基于web的配置界面。 ICQ Toolbar没有验证所加载Web页面的位置或来源，因此可以从本地系统或在线配置工具栏。这允许攻击者轻易的拷贝本地保存的options2.html文件的内容并做为html文件上传到任意站点。 每个复选框控件关联到配置设置的方法仅仅是将每个HTML复选框标签的ID属性匹配到期望配置ID的列表。这允许攻击者更改复选框控件的外部表现以掩饰攻击。只要ID属性匹配了相关的配置设置，攻击者就可以向用户浏览器中呈现任意HTML。上述两个漏洞都允许攻击者读取并更改ICQ工具栏配置。 标准RSS feed...

AOL YGPPDownload ActiveX buffer overflow

Buffer overflow in SetAlbumName method of YGPPicDownload.dll AOL.PicDownloadCtrl.1...

CVE-2006-3888

Buffer overflow in AOL You've Got Pictures YGP Pic Downloader YGPPDownload ActiveX control AOL.PicDownloadCtrl.1, YGPPicDownload.dll, as used in America Online 9.0 Security Edition, allows remote attackers to execute arbitrary code via a long argument to the SetAlbumName method...

CVE-2006-3887

Buffer overflow in AOL You've Got Pictures YGP Screensaver ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2006-3887

The CVE-2006-3887 issue affects AOL’s You’ve Got Pictures (YGP) Screensaver ActiveX control. A buffer overflow in the ActiveX control may allow a remote attacker to execute arbitrary code on a vulnerable system when a user is convinced to view a crafted HTML document. This is associated with the ...

CVE-2006-3888

Buffer overflow in AOL You've Got Pictures YGP Pic Downloader YGPPDownload ActiveX control AOL.PicDownloadCtrl.1, YGPPicDownload.dll, as used in America Online 9.0 Security Edition, allows remote attackers to execute arbitrary code via a long argument to the SetAlbumName method...

CVE-2006-3887

Buffer overflow in AOL You've Got Pictures YGP Screensaver ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2006-3888

The CVE-2006-3888 issue affects AOL You’ve Got Pictures (YGP) Pic Downloader ActiveX control (AOL.PicDownloadCtrl.1, YGPPicDownload.dll) used in AOL 9.0 Security Edition. A buffer overflow allows remote attackers to execute arbitrary code via a long argument to SetAlbumName. The vulnerability is ...

AOL YGP Screensaver ActiveX control buffer overflow

Overview The AOL YGP Screensaver ActiveX control contains a buffer overflow vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The AOL YGP You've Got Pictures Screensaver ActiveX control is a component that comes with AO...

AOL YGP Pic Downloader Plugin ActiveX control buffer overflow

Overview The AOL YGP Pic Downloader ActiveX control contains a buffer overflow vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The AOL YGP You've Got Pictures Pic Downloader ActiveX control is a component that comes...

AOL Instant Messenger goaway Overflow

This module exploits a flaw in the handling of AOL Instant Messenger's 'goaway' URI handler. An attacker can execute arbitrary code by supplying an overly sized buffer as the 'message' parameter. This issue is known to affect AOL Instant Messenger 5.5. This module requires Metasploit:...

AOL ICQ Pro fails to properly handle incoming message lengths

Overview A buffer overflow vulnerability in ICQ may allow a remote attacker to execute arbitrary code or create a denial-of-service condition. Description ICQ is a instant messaging application that is maintained by AOL. A buffer overflow vulnerability in ICQ Pro 2003b may allow a remote,...

CVE-2006-4661

AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll does not properly validate the origin of the configuration web page options2.html, which allows user-assisted remote attackers to provide a web page that contains disguised checkboxes that trick the user into reconfiguring the toolbar...

CVE-2006-4662

Heap-based buffer overflow in the MCRegExSearch function in AOL ICQ Pro 2003b Build 3916 and earlier allows remote attackers to execute arbitrary code via an inconsistent length field of a Message in a 0x2711 Type-Length-Value TLV type...

CVE-2006-4661

CVE-2006-4661 affects AOL ICQ Toolbar 1.3 for Internet Explorer (toolbaru.dll). The vulnerability stems from insufficient validation of the origin of the configuration page (options2.html), enabling an attacker to present a crafted web page with disguised checkboxes to trick the user into reconfi...

CVE-2006-4661

AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll does not properly validate the origin of the configuration web page options2.html, which allows user-assisted remote attackers to provide a web page that contains disguised checkboxes that trick the user into reconfiguring the toolbar...

CVE-2006-4662

CVE-2006-4662 describes a heap-based overflow in AOL ICQ Pro 2003b (Build 3916 and earlier) triggered in MCRegEx__Search by an inconsistent 0x2711 TLV length field in a message. The overflow occurs when a length value is used to memset a heap buffer, enabling remote code execution. Affected produ...

CVE-2006-4660

CVE-2006-4660 concerns multiple XSS vulnerabilities in the RSS Feed module of AOL ICQ Toolbar 1.3 for Internet Explorer. The weaknesses arise from the RSS feed item fields (title and description) being appended to HTML output without sanitization, enabling remote attackers to execute arbitrary sc...

CVE-2006-4660

Multiple cross-site scripting XSS vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer toolbaru.dll allow remote attackers to process arbitrary web script or HTML in the Feeds interface context via the 1 title and 2 description elements within an item element in an...