CVE-2006-4662

CVE-2006-4662 describes a heap-based overflow in AOL ICQ Pro 2003b (Build 3916 and earlier) triggered in MCRegEx__Search by an inconsistent 0x2711 TLV length field in a message. The overflow occurs when a length value is used to memset a heap buffer, enabling remote code execution. Affected produ...

CVE-2006-0765

CVE-2006-0765 describes a GUI display truncation in ICQ 2003a/2003b and ICQ Lite 4.0/4.1 on Windows, where a filename that is all uppercase and of a specific length causes the malicious file extension to be truncated in the UI, allowing user-assisted remote attackers to bypass security warnings a...

CVE-2003-0237

CVE-2003-0237 affects Mirabilis ICQ Pro 2003a via the ICQ Features on Demand spoofing vulnerability. The hard-coded DataURL for downloaded features in Packages.ini is not authenticated, allowing an attacker to impersonate the package repository and install malicious software, potentially enabling...

CVE-2006-0766

CVE-2006-0766 affects ICQ software on Windows (ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions). The vulnerability stems from the ability for an attacker to craft a filename that ends with a commonly trusted extension (e.g., .JPG) and potentially alter properties like co...

CVE-2000-0564

The vulnerability CVE-2000-0564 affects the guestbook CGI in the ICQ Web Front service (ICQ 2000a, 99b). The flaw permits remote denial of service when a URL with an excessively long name parameter is requested. Exploitation details are not provided in the documents; no patch/version remediation ...

CVE-2001-0367

The vulnerability CVE-2001-0367 affects Mirabilis ICQ WebFront Plug-in for ICQ2000b (Build 3278). A remote attacker can cause a denial of service by sending HTTP URL requests containing a large number of percent characters. The issue impacts availability (PARTIAL) with a CVSS v2 base score of 5.0...

CVE-2002-2075

The CVE-2002-2075 entry affects ICQ 2001a and ICQ 2002b. The vulnerability allows remote attackers to cause a denial of service via a contact message containing a large number of contacts, leading to memory consumption and a hang. The connected documents confirm the affected software and the impa...

CVE-2003-0235

CVE-2003-0235 is a format string vulnerability in Mirabilis ICQ Pro 2003a's integrated POP3 client (POP3.dll). The bug resides in the UIDL server response string, where format specifiers can be exploited by a remote attacker posing as the POP3 server, potentially enabling arbitrary code execution...

CVE-2003-0769

CVE-2003-0769 describes a cross-site scripting (XSS) flaw in ICQ Web Front guestbook (guestbook.html) where an attacker can inject arbitrary script via the message field. The vulnerability arises in the guestbook component, enabling potentially arbitrary HTML/script execution by remote attackers....

CVE-2002-2329

CVE-2002-2329 affects ICQ client versions 2001b, 2002a and 2002b. The vulnerability allows remote attackers to cause a denial of service (CPU consumption or crash) by sending a message containing a large number of emoticons. The connected Red Hat and CVE listing entries confirm the same impact. N...

CVE-2001-1305

CVE-2001-1305 affects ICQ 2001a Alpha and earlier. A remote attacker can cause an ICQ user’s contact list to automatically include arbitrary UINs by visiting a web page whose Content-Type is set to application/x-icq, which IE processes. The connected documents consistently describe ICQ as vulnera...

CVE-1999-0474

CVE-1999-0474 concerns the ICQ Webserver, where remote attackers can exploit a path traversal issue (using ..) to access files outside the user’s personal directory. Public sources corroborate an access-control/authorization bypass leading to potential partial confidentiality impact (CVSS v2 base...

CVE-1999-1289

ICQ 98 beta on Windows NT leaks the internal IP address of a client in the TCP data segment of an ICQ packet instead of the public address (e.g., via NAT), potentially exposing sensitive information about the client or internal network configuration. The description does not specify affected vers...

CVE-2003-0236

CVE-2003-0236 concerns Mirabilis ICQ Pro 2003a’s integrated POP3 client (POP3.dll COM object). The vulnerability is a 16‑bit signed overflow in the Subject and Date headers (Subject/Date fields) of e‑mail messages, allowing an attacker to craft headers that can execute arbitrary commands on a vul...

CVE-2003-0239

CVE-2003-0239 concerns the GIF89a parsing/rendering library in Mirabilis ICQ Pro 2003a (icqateimg32.dll). Affected: ICQ Pro 2003a and earlier. Issue: input validation error when parsing GIF headers that lack a Global Color Table (GCT) or Local Color Table (LCT) after an Image Descriptor, enabling...

CVE-2002-0028

CVE-2002-0028 describes a remote code execution vulnerability in the Windows ICQ client prior to the 2001B Beta v5.18 Build #3659, triggered by processing a Voice Video & Games request. The buffer overflow occurs in code handling that TLV/message and, before 2001B, in the core client (and in 2001...

CVE-2003-0238

CVE-2003-0238 impacts Mirabilis ICQ Pro 2003a and earlier. The flaw resides in ICQ’s Message Session HTML rendering library used by the ADS/advertising component. By spoofing the ADS server and sending malformed HTML, an attacker can trigger a denial-of-service condition, consuming CPU and freezi...

CVE-2002-1743

Technical details about CVE-2002-1743 are not provided in the supplied documents. No concrete information on affected components or impact is available here; monitor for updates.

CVE-2000-0046

CVE-2000-0046 is a buffer overflow vulnerability in the ICQ 99b 1.1.1.1 client that allows remote attackers to execute commands by sending a malformed URL contained in an ICQ message. The available connected documents confirm ICQ is installed on affected hosts and reference the CVE in multiple vu...

CVE-2006-5724

The CVE-2006-5724 entry describes a heap-based buffer overflow in ICQ 2003b Build 3916, specifically in the Answering Service function. The vulnerability can be triggered by a long string in the AwayMsg Presets value stored under ICQ\ICQPro\DefaultPrefs\Presets, allowing a local user to cause an ...

CVE-2005-3433

CVE-2005-3433 affects Mirabilis ICQ 2003a. The vulnerability is a buffer overflow in the First Name and Last Name fields, caused by processing long user-provided strings, which can lead to arbitrary code execution when a user is manipulated to enter such strings. The documents specify user-assist...

CVE-2006-2303

CVE-2006-2303 describes a Cross-Application Scripting (XAS) vulnerability in ICQ Client 5.04 build 2321 and earlier. The flaw allows a remote attacker to inject arbitrary web script from one application into another via a banner, which is processed in the My Computer zone using the Internet Explo...

CVE-2002-0254

CVE-2002-0254 affects ICQ 2001b Build 3659. The vulnerability allows a remote attacker to cause a denial-of-service (crash) by supplying a malformed picture containing abnormally large height and width values, which triggers the crash when the image is viewed in Userdetails. The available records...