CVE-2002-0032

Yahoo! Messenger 5.0.0.1064 and earlier is vulnerable to remote arbitrary-script execution via the addview parameter of the ymsgr URI. The issue stems from Yahoo! Messenger URI handling, allowing an attacker to run code with the victim’s privileges. The advisory/references indicate remediation by...

CVE-2012-0268

CVE-2012-0268 describes an integer overflow in Yahoo! Messenger’s YImage.dll CYImage::LoadJPG when photo sharing is enabled, leading to a heap-based buffer overflow that could allow remote code execution via a crafted JPG. Affected are Yahoo! Messenger versions up to and including 11.5.0.155 (old...

CVE-2002-0320

CVE-2002-0320: Buffer overflow in Yahoo! Messenger 5.0 allows a remote attacker to cause a denial of service and possibly execute arbitrary code via a long message or the IMvironment field. The CERT advisories specify a remotely exploitable overflow in the message field and in the IMvironment fie...

CVE-2005-0737

CVE-2005-0737 describes a buffer overflow in Yahoo! Messenger that allows remote attackers to execute arbitrary code via the offline mode. The vulnerability is associated with Yahoo! Messenger; the underlying cause is a buffer overflow condition, enabling potential arbitrary code execution and im...

CVE-2007-3147

CVE-2007-3147 describes a buffer overflow in Yahoo! Messenger 8.1.0.249’s Webcam ActiveX control (ywcupl.dll v2.0.1.4). The vulnerability occurs when a long value is sent via the Server() method to the Send() method, allowing remote arbitrary code execution. Connected sources also reference buffe...

CVE-2007-0868

CVE-2007-0868 concerns an unspecified vulnerability in the chat room feature of Yahoo! Messenger up to version 8.1.0.239, allowing a remote attacker to cause a denial of service. The impact is described as partial availability loss, with no confidentiality or integrity impact stated. The vulnerab...

CVE-2002-0322

CVE-2002-0322 affects Yahoo! Messenger 4.0. The vulnerability arises because user passwords are sent in cleartext, enabling remote attackers to sniff credentials and potentially gain privileges of other users. The issue impacts confidentiality and integrity (partial), with a network-based attack ...

CVE-2007-1680

CVE-2007-1680 is a stack-based buffer overflow in Yahoo! Messenger’s AudioConf ActiveX control (yacscom.dll). The vulnerability occurs when the createAndJoinConference method is called with excessively long socksHostname or hostname parameters, enabling remote code execution under the current use...

CVE-2003-1135

CVE-2003-1135 concerns Yahoo! Messenger 5.6, where a buffer overflow in the sendfile handling can be triggered by a crafted file send request containing a large number of percent characters after the Yahoo ID. The issue is described as a denial of service (crash). Connected sources consistently i...

CVE-2006-6603

CVE-2006-6603 is a buffer overflow in Yahoo! Messenger’s YMMAPI.YMailAttach ActiveX control (ymmapi.dll). A crafted HTML document could trigger code execution with the user’s privileges. The vulnerability affects Yahoo! Messenger prior to version 2005.1.1.4; Yahoo’s security update fixes versions...

CVE-2007-4515

CVE-2007-4515 is a buffer overflow vulnerability in Yahoo! Messenger’s YVerInfo.dll ActiveX control (pre-7/27/2007 build). The issue allows remote code execution via faulty arguments to fvCom and info methods, affecting Messenger prior to 8.1.0.419. Documents show public exploitation modules (e.g...

CVE-2014-7216

CVE-2014-7216 affects Yahoo! Messenger ≤ 11.5.0.228. A stack-based buffer overflow is caused by unvalidated lengths in the emoticons.xml file’s shortcut and title values, leading to possible code execution or crash. Exploitation requires the victim to process a manipulated emoticons package (e.g....

CVE-2005-0242

The CVE-2005-0242 vector affects Yahoo! Messenger (Windows), where the Audio Setup Wizard (asw.dll) could execute arbitrary code by placing a malicious ping.exe in the Messenger directory due to weak default permissions. The vulnerability enables local code execution with the privileges of the us...

CVE-2007-0768

CVE-2007-0768 affects Yahoo! Messenger

CVE-2007-4635

CVE-2007-4515 and CVE-2007-4635 pertain to Yahoo! Messenger, targeting the YVerInfo.dll ActiveX control. The root cause is a buffer overflow in the ActiveX methods fvCom and info, exploitable by crafted inputs. CVE-2007-4515 describes a pre-8.1.0.419 condition allowing remote code execution; CVE-...

CVE-2007-5017

CVE-2007-5017 describes an absolute path traversal vulnerability in a specific ActiveX control (the CYFT object in ft60.dll) used by Yahoo! Messenger 8.1.0.421. An attacker could supply a full pathname to the GetFile method to force a download or create/overwrite arbitrary files on the affected s...

CVE-2005-0243

Yahoo! Messenger 6.0.0.1750 (and potentially earlier than 6.0.0.1921) is affected by a filename spoofing vulnerability in the file transfer dialog where long filenames are not displayed correctly. This can lead users to download and open a misrepresented executable. The issue is mitigated by upda...

CVE-2007-3148

CVE-2007-3148 : A buffer overflow in the Yahoo! Messenger Webcam Viewer ActiveX control (ywcvwr.dll 2.0.1.4) used by Yahoo! Messenger 8.1.0.249 can be triggered by a long server property value sent to the receive method, allowing remote code execution. Public advisories and scans describe this as...

CVE-2002-0321

Yahoo! Messenger 5.0 is affected by a vulnerability that lets a remote attacker spoof another user’s name in messages, enabling social engineering or a denial-of-service via flooding. The issue arises from the ability to modify the source username used in messages. Impact is described as potentia...

CVE-2006-3298

CVE-2006-3298 affects Yahoo! Messenger versions 7.5.0.814 and 7.0.438. The vulnerability allows remote attackers to cause a crash in jscript.dll by sending messages containing non-ASCII characters. The NVD entry, with CVSS v2 base score 5.0 (Medium), lists network access, no authentication, and p...

CVE-2007-4391

CVE-2007-4391 describes a heap-based buffer overflow in Kakadu kdu_v32m.dll used by Yahoo! Messenger 8.1.0.413 that can be triggered by a crafted JPEG2000 length field in a webcam invitation, potentially causing an application crash or remote code execution. Public disclosures link the issue to Y...

CVE-2004-0043

CVE-2004-0043 relates to a buffer overflow in Yahoo Messenger before and including version 5.6.0.1351, triggered by a long filename in the download feature. The vulnerability can cause a denial of service and, potentially, remote code execution. Affected software is Yahoo Instant Messenger, with ...

CVE-2005-1671

The CVE-2005-1671 issue affects Yahoo! Messenger 5.x through 6.0, where the Logfile feature can be activated via a YMSGR: URL. This causes output to be written to a single ypager.log file across multiple users, and there is no proper warning to subsequent users that the feature is enabled, enabli...

CVE-2005-1618

The CVE-2005-1618 entry describes a DoS in Yahoo! Messenger (YMSGR URL handler) for versions 5.x–6.0. A room login/join packet containing a colon and ampersand can cause Messenger to send a corrupted packet to the server, triggering a disconnect. Concrete impact is denial of service; exploitation...

CVE-2002-1664

Yahoo! Messenger vulnerability CVE-2002-1664: Before February 2002, remote attackers could add arbitrary users to another user’s buddy list, potentially exposing sensitive information. The NVD/CVE entries describe this as a buddy-list manipulation issue with partial confidentiality risk; no expli...

CVE-2007-3928

Yahoo! Messenger 8.1 is affected by CVE-2007-3928 due to a buffer overflow in address-book entries. An authenticated user can exploit a long e-mail address in an address book to execute arbitrary code on the victim’s system. The issue is described as a remote code execution vector with user inter...

CVE-2002-1665

CVE-2002-1665 describes a buffer overflow in Yahoo! Messenger prior to February 2002, exploitable via a long set_buddygrp field that could cause a crash and potentially allow arbitrary code execution. The affected component is Yahoo! Messenger, with the root cause being an overflow in handling th...

CVE-2002-2361

The vulnerability CVE-2002-2361 affects Yahoo! Messenger installers (versions 4.0, 5.0, 5.5). The root cause is that the installer does not verify package signatures, allowing a remote attacker to substitute a trojan-laden package via DNS spoofing. Practical impact is installation of unauthentica...

CVE-2009-4171

Vulnerability: Yahoo! Messenger’s YahooBridgeLib.dll ActiveX control (9.0.x) is affected by a denial-of-service via a NULL pointer dereference when the RegisterMe method is called with a long argument. Root cause: improper handling in the ActiveX method leading to crash (partial availability impa...

CVE-2002-0031

Affected software: Yahoo! Messenger for Windows, version 5.0.0.1064 and earlier. Vulnerability: a remote buffer overflow in the Yahoo! Messenger URI handler (ymsgr:), sharing a single vulnerable buffer for multiple functions (e.g., getimv, sendim, message, addview, adduser, call, chat). Impact: m...

CVE-2006-4975

CVE-2006-4975 concerns Yahoo! Messenger for WAP, where saving messages that contain JavaScript enables user-assisted remote script/HTML injection via a URL on the service. The vulnerability is tied to how messages could be stored and later rendered, allowing arbitrary script execution in affected...

CVE-2007-3638

CVE-2007-3638 is linked to a Yahoo! Messenger 8.1 buffer overflow issue. Related connected records (CVE-2007-3928) describe a buffer overflow allowing remote code execution via a long e-mail address in an address book entry by user-assisted remote authenticated users; this might overlap CVE-2007-...

CVE-2006-5563

CVE-2006-5563 affects Yahoo! Messenger (Service 18) before 8.1.0.195. Remote attackers can cause a denial of service (NULL dereference and application crash) via a crafted room name in a Conference Invite. This is the only technical detail provided by the sources; no further exploit steps, affect...