Unscored severity · published Apr 6, 2007
CVE-2007-1680
Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to…
–
CVSS
8.4%
EPSS
No
On KEV
Description
Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to execute arbitrary code via long (1) socksHostname and (2) hostname properties.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Messenger · Yahoo
8.0; 8.0.0.863; 8.0_2005.1.1.4; 8.1.0.209; 8.1.0.239 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1680
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1680
Patch
http://messenger.yahoo.com/security_update.php?id=031207
osvdb.org
http://osvdb.org/34319
Patch
http://secunia.com/advisories/24742
securityreason.com
http://securityreason.com/securityalert/2523
US Government Resource
http://www.kb.cert.org/vuls/id/388377
www.securityfocus.com
http://www.securityfocus.com/archive/1/464607/100/0/threaded
More from Messenger
–
CVE-2014-7216
Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code…
–
CVE-2012-0268
Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute…
–
CVE-2009-4171
An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remote attackers to cause a denial of service (NULL pointer…
–
CVE-2007-5017
Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.1.0.421 allows remote attackers to force a download, and…
–
CVE-2007-4635
Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer…