CVE-2002-2162

Cerulean Studios Trillian 0.73 and earlier stores passwords in .ini files in the Trillian directory using weak XOR encryption, enabling local users to access other users’ credentials. Affected product/version: Trillian

CVE-2008-5403

CVE-2008-5403 : Heap-based buffer overflow in the XML parser of Trillian’s AIM plugin (aim.dll) allows remote attackers to execute arbitrary code when parsing malformed XML tags. Affected product: Cerulean Studios Trillian (AIM plugin). Vulnerability arises from a boundary/allocation error in XML...

CVE-2009-4831

Cerulean Studios Trillian 3.1 Basic does not verify SSL certificates during MSN authentication, enabling remote attackers to obtain MSN credentials via a man-in-the-middle with a spoofed certificate. CVE-2009-4831. The entry notes a MEDIUM base score (5.8) with network attack vector, no authentic...

CVE-2001-1419

The CVE-2001-1419 entry concerns AOL Instant Messenger (AIM) versions 4.7.2480 and earlier. The vulnerability arises when processing an instant message containing a large amount of HTML comments "

CVE-2005-0633

The CVE-2005-0633 issue affects Trillian 3.0 and Trillian Pro 3.0. It is described as a buffer overflow that allows remote attackers to execute arbitrary code through a crafted PNG image file. The available sources consistently state remote code execution is possible due to the overflow, but do n...

CVE-2008-5402

Trillian has a CVE-2008-5402 vulnerability: a double-free in the XML parser before version 3.1.12.0 can enable remote code execution via crafted XML (notably the IMG SRC ID payload). Public sources (ZDI-08-078, OpenVAS entries, and NVD record) corroborate a remote memory corruption/ARiC condition...

CVE-2007-2479

CVE-2007-2479 affects Cerulean Studios Trillian Pro before 3.1.5.1. The vulnerability arises from processing long CTCP PING messages containing UTF-8 characters, producing a malformed response that is not truncated by a newline, which can cause portions of a server message to be sent to an attack...

CVE-2006-0543

Cerulean Trillian 3.1.0.120 is affected by CVE-2006-0543. A remote attacker can crash the Trillian client by sending an AIM message that contains Mac-encoded RTF escape sequences (\’d1, \’d2, \’d3, \’d4, \’d5). The vulnerability is a denial of service against the client; no exploitation details o...

CVE-2008-5401

CVE-2008-5401 affects Trillian Messenger. A stack-based buffer overflow in the image tooltip parsing (AIM IMG Tag Parsing) allows remote code execution via a long image filename and impacts Trillian versions up to 3.1.11.0; vulnerable until 3.1.11.0, with 3.1.12.0 addressing the issue. Remediatio...

CVE-2002-2390

CVE-2002-2390 concerns a buffer overflow in the IDENT daemon (identd) used by Trillian. Affects Trillian versions 0.6351, 0.725, 0.73, 0.74 and 1.0 pro; vulnerability arises from handling a long request, enabling remote denial of service (crash) and potentially arbitrary code execution. Public de...

CVE-2007-3305

CVE-2007-3305 concerns Cerulean Studios Trillian 3.x before 3.1.6.0, where a heap-based buffer overflow occurs during UTF-8 handling when word-wrapping a message (buffer size driven by window width). The flaw allows remote attackers to execute arbitrary code via crafted UTF-8 text sent through MS...

CVE-2004-2304

CVE-2004-2304 affects Trillian (0.74 and earlier) and Trillian Pro (2.01 and earlier). The issue is an integer/heap-based buffer overflow triggered by a DirectIM packet, enabling remote denial of service and potentially arbitrary code execution. Connected sources reference a DirectIM overflow in ...

CVE-2005-3141

CVE-2005-3141 affects Cerulean Studios Trillian 3.0. A remote attacker can cause a crash (denial of service) by initiating a reverse direct connection from a different client, demonstrated using LICQ. The provided documents do not specify exact vulnerable components/versions beyond Trillian 3.0 o...

CVE-2002-2173

The CVE-2002-2173 entry describes a buffer overflow in the Trillian IRC module (versions 0.725 and 0.73). It allows remote attackers to execute arbitrary code via a long DCC Chat message. The available connected sources confirm the vulnerable component and impact but do not provide detailed root-...

CVE-2004-2370

CVE-2004-2370 describes a stack-based buffer overflow in Trillian 0.71–0.74f and Trillian Pro 1.0–2.01 that allows remote attackers to execute arbitrary code via a Yahoo Messenger packet with a long key name. Affected component: Trillian client software; root cause: stack-based overflow in proces...

CVE-2002-1487

The CVE-2002-1487 entry concerns the IRC component of Trillian versions 0.73 and 0.74. The vulnerability allows remote malicious IRC servers to cause a denial of service (crash) by sending any of the 15 specified raw messages (numbers 206, 211, 213, 214, 215, 217, 218, 243, 302, 317, 324, 332, 33...

CVE-2005-0874

The CVE-2005-0874 entry covers multiple buffer overflows in Trillian 2.0 plug-ins (AIM, MSN, RSS, and others). The root cause is deficient handling of long strings in an HTTP/1.1 response header, enabling a remote attacker to trigger a denial of service (application crash). Exploitation details a...

CVE-2002-1486

CVE-2002-1486 affects Trillian's IRC component (versions 0.73 and 0.74). The issue consists of multiple buffer overflows that allow a remote IRC server to cause denial of service and potentially execute arbitrary code. Exploitation vectors include: (1) a large response from the server, (2) a JOIN...

CVE-2003-0520

CVE-2003-0520 affects Trillian 1.0 Pro and 0.74 Freeware. The issue allows remote attackers to trigger a denial of service (crash) by sending a TypingUser message in which the TypingUser string has been modified. The description in the CVE entries consistently states that the crash is caused by t...

CVE-2004-1666

CVE-2004-1666 describes a buffer overflow in the MSN module of Trillian 0.74i. A long string ending in a newline, processed by the MSN component, can be exploited by a remote MSN server to execute arbitrary code on a vulnerable client. The vulnerability is triggered via the MSN protocol handling ...

CVE-2007-3833

CVE-2007-3833 affects Cerulean Trillian’s AIM protocol URI handler. A buffer overflow in the AIM URI handler (aim.dll) and the ability to create arbitrary files via crafted aim:// URIs can enable remote code execution as the current user. Impact described as launching code via startup folder writ...

CVE-2002-2155

CVE-2002-2155 affects Trillian (versions 0.725 and 0.73). The vulnerability is a format string issue in the error handling of IRC invite responses, enabling a remote attacker (IRC server) to cause arbitrary code execution by sending an invite to a channel whose name contains format specifiers. Do...

CVE-2007-3832

The CVE-2007-3832 issue affects Trillian before 3.1.7.0, where a buffer overflow in the AIM protocol URI handler (aim.dll) can be triggered by specially crafted aim:// URIs. An unauthenticated remote attacker could potentially execute arbitrary code with the user’s privileges by convincing a user...

CVE-2002-2366

The CVE-2002-2366 entry concerns Trillian (versions 0.6351, 0.725 and 0.73) with a buffer overflow in the XML parser. The vulnerability can be triggered by a skin with a long colors filename in trillian.xml, allowing remote attackers to cause a crash and possibly execute arbitrary code. The descr...

CVE-2012-5824

CVE-2012-5824 affects Trillian 5.1.0.19: it does not verify the server hostname against the certificate's CN or subjectAltName, enabling MITM via an arbitrary valid certificate. CVSSv2 base score 5.8 (Medium). No fix/version details are provided in the supplied documents.

CVE-2002-2156

CVE-2002-2156: A buffer overflow in Trillian 0.73 allows remote IRC servers to execute arbitrary code via a long PING response. This CVE affects Trillian 0.73 and enables remote code execution on vulnerable hosts; no remediation details are provided in the supplied documents. References from Red ...

CVE-2008-2409

CVE-2008-2409 concerns Cerulean Studios Trillian prior to 3.1.10.0. Multiple sources (NVD, ZDI, CVE lists, Nessus plugin) describe a stack-based buffer overflow in the MSN protocol header parsing, specifically in the X-MMS-IM-FORMAT header. This flaw allows remote attackers to execute arbitrary c...

CVE-2002-1485

The CVE-2002-1485 entry concerns the AIM component of Trillian versions 0.73 and 0.74. A remote attacker can cause a denial of service (crash) by sending certain strings (e.g., "P > O

CVE-2002-1488

CVE-2002-1488 affects the IRC component of Trillian in versions 0.73 and 0.74. The issue allows remote malicious IRC servers to cause a denial of service (crash) by sending a PART message with (1) a missing channel or (2) a channel that the Trillian user is not in. This is a network-vector impact...

CVE-2008-2008

Affected software: Cerulean Studios Trillian Basic and Pro 3.1.9.0. Component: Display Names message feature. Root cause: buffer overflow triggered by a long nickname in an MSN protocol message. Impact: remote attackers can cause a denial of service (crash) or execute arbitrary code. Exploitation...

CVE-2005-0875

CVE-2005-0875 affects the Yahoo plug-in for Trillian versions 2.0, 3.0, and 3.1. The issue is caused by multiple buffer overflows that allow a remote web server to crash the application (DoS) by sending a long string in an HTTP/1.1 response header. The NVD entry documents this as a denial-of-serv...