CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Yahoo » Messenger : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-7216 119 DoS Exec Code Overflow 2015-09-11 2018-10-09
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) shortcut or (2) title keys in an emoticons.xml file.
2 CVE-2012-0268 189 Exec Code Overflow 2012-01-19 2012-01-23
5.1
 None Remote High Not required Partial Partial Partial
Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute arbitrary code via a crafted JPG image that triggers a heap-based buffer overflow.
3 CVE-2009-4171 119 DoS Overflow 2009-12-02 2018-10-10
4.3
 None Remote Medium Not required None None Partial
An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by calling the RegisterMe method with a long argument.
4 CVE-2007-5017 22 Dir. Trav. 2007-09-20 2017-09-29
5.0
 None Remote Low Not required None Partial None
Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.1.0.421 allows remote attackers to force a download, and create or overwrite arbitrary files via a full pathname in the second argument to the GetFile method.
5 CVE-2007-4635 119 DoS Overflow 2007-08-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer overflow, as demonstrated by ym8bug.exe. NOTE: this might be related to CVE-2007-4515. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
6 CVE-2007-4515 119 Exec Code Overflow 2007-08-31 2017-07-29
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these details are obtained from third party information.
7 CVE-2007-4391 119 DoS Overflow 2007-08-17 2017-07-29
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then injecting a DLL into the attacker's peer Yahoo! Messenger application when this request is accepted.
8 CVE-2007-3928 119 Exec Code Overflow 2007-07-21 2017-07-29
7.6
 None Remote High Not required Complete Complete Complete
Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users to execute arbitrary code via a long e-mail address in an address book entry. NOTE: this might overlap CVE-2007-3638.
9 CVE-2007-3638 119 Exec Code Overflow 2007-07-10 2008-09-05
6.0
 None Remote Medium ??? Partial Partial Partial
Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users, who are listed in an address book, to execute arbitrary code via unspecified vectors, aka ZD-00000005. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
10 CVE-2007-3148 119 Exec Code Overflow 2007-06-11 2018-10-16
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the receive method.
11 CVE-2007-3147 119 Exec Code Overflow 2007-06-11 2018-10-16
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the send method. NOTE: some of these details are obtained from third party information.
12 CVE-2007-1680 Exec Code Overflow 2007-04-06 2018-10-16
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to execute arbitrary code via long (1) socksHostname and (2) hostname properties.
13 CVE-2007-0868 DoS 2007-02-09 2008-11-15
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
14 CVE-2007-0768 XSS 2007-02-06 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG element to the (1) First Name, (2) Last Name, and (3) Nickname fields. NOTE: some of these details are obtained from third party information.
15 CVE-2006-6603 Exec Code Overflow 2006-12-15 2011-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code via a crafted HTML document. NOTE: some details were obtained from third party information.
16 CVE-2006-5563 DoS 2006-10-27 2018-10-17
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in Yahoo! Messenger (Service 18) before 8.1.0.195 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted room name in a Conference Invite. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
17 CVE-2006-4975 2006-09-25 2018-10-17
2.6
 None Remote High Not required None Partial None
Yahoo! Messenger for WAP permits saving messages that contain JavaScript, which allows user-assisted remote attackers to inject arbitrary web script or HTML via a URL at the online service.
18 CVE-2006-3298 DoS 2006-06-29 2017-07-20
5.0
 None Remote Low Not required None None Partial
Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service (crash) via messages that contain non-ASCII characters, which triggers the crash in jscript.dll.
19 CVE-2005-1671 +Info 2005-05-19 2016-10-18
2.1
 None Local Low Not required Partial None None
The Logfile feature in Yahoo! Messenger 5.x through 6.0 can be activated by a YMSGR: URL and writes all output to a single ypager.log file, even when there are multiple users, and does not properly warn later users that the feature has been enabled, which allows local users to obtain sensitive information from other users.
20 CVE-2005-1618 DoS 2005-05-16 2016-10-18
5.0
 None Remote Low Not required None None Partial
The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconnect) via a room login or a room join request packet with a third : (colon) and an & (ampersand), which causes Messenger to send a corrupted packet to the server, which triggers a disconnect from the server.
21 CVE-2005-0737 Exec Code Overflow 2005-05-02 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.
22 CVE-2005-0243 2005-02-17 2008-09-05
5.0
 None Remote Low Not required None Partial None
Yahoo! Messenger 6.0.0.1750, and possibly other versions before 6.0.0.1921, does not properly display long filenames in file dialog boxes, which could allow remote attackers to trick users into downloading and executing programs via file names containing a large number of spaces and multiple file extensions.
23 CVE-2005-0242 2005-02-18 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The Audio Setup Wizard (asw.dll) in Yahoo! Messenger 6.0.0.1750, and possibly other versions, allows attackers to arbitrary code by placing a malicious ping.exe program into the Messenger program directory, which is installed with weak default permissions.
24 CVE-2004-0043 DoS Exec Code Overflow 2004-02-03 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Yahoo Instant Messenger 5.6.0.1351 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in the download feature.
25 CVE-2003-1135 DoS Overflow 2003-12-31 2008-09-05
2.6
 None Remote High Not required None None Partial
Buffer overflow in Yahoo! Messenger 5.6 allows remote attackers to cause a denial of service (crash) via a file send request (sendfile) with a large number of "%" (percent) characters after the Yahoo ID.
26 CVE-2002-2361 264 2002-12-31 2008-09-05
5.8
 None Remote Medium Not required Partial Partial None
The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan programs via DNS spoofing.
27 CVE-2002-1665 DoS Exec Code Overflow 2002-12-31 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long set_buddygrp field.
28 CVE-2002-1664 +Info 2002-12-31 2016-10-18
6.4
 None Remote Low Not required Partial Partial None
Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user's buddy list and possibly obtain sensitive information.
29 CVE-2002-0322 +Priv 2002-06-25 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing.
30 CVE-2002-0321 DoS 2002-06-25 2016-10-18
5.0
 None Remote Low Not required None Partial None
Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engineering or denial of service (flooding) attacks.
31 CVE-2002-0320 DoS Exec Code Overflow 2002-06-25 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) message or (2) IMvironment field.
32 CVE-2002-0032 2002-07-26 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI.
33 CVE-2002-0031 Exec Code Overflow 2002-07-26 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long arguments to (1) call, (2) sendim, (3) getimv, (4) chat, (5) addview, or (6) addfriend.
Total number of vulnerabilities : 33   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.