Buffer Overflow in AudioConf ActiveX Control of Yahoo! Messenger
CVE-2007-1680

Currently unrated

Key Information:

Vendor: Yahoo
Status: Messenger
Vendor: CVE Published:; 6 April 2007

What is CVE-2007-1680?

The AudioConf ActiveX control in Yahoo! Messenger versions prior to March 13, 2007, contains a stack-based buffer overflow vulnerability in its createAndJoinConference function. This flaw can be exploited by remote attackers through crafted inputs provided to the socksHostname and hostname properties, potentially allowing the execution of arbitrary code on the victim's machine. Users are advised to update to the latest version of Yahoo! Messenger to remediate this vulnerability.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/33408

vdb-entryx_refsource_XF

http://www.securityfocus.com/bid/23291

vdb-entryx_refsource_BID

http://secunia.com/advisories/24742

third-party-advisoryx_refsource_SECUNIA

EPSS Score

8% chance of being exploited in the next 30 days.

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 6, 2007
Vulnerability Reserved
Mar 26, 2007

CVE-2007-1680 Data

JSON