PT-2015-3915 · Yahoo · Yahoo! Messenger

Julien Ahrens · Publicado 2015-09-11 · Atualizado 2018-10-09 · CVE-2014-7216

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 11.5.0.228 and earlier

Description The issue is related to multiple stack-based buffer overflows that can be triggered by remote attackers. This can lead to a denial of service, causing the application to crash, and potentially allow the execution of arbitrary code. The overflows can occur via the shortcut or title keys in an emoticons.xml file.

Recommendations For Yahoo! Messenger versions 11.5.0.228 and earlier, update to a version later than 11.5.0.228 to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-7216

Produtos afetados

Yahoo! Messenger

Referências · 7

• 🔥 https://rcesecurity.com/2015/09/cve-2014-7216-a-journey-through-yahoos-bug-bounty-program · Exploit
• http://securityfocus.com/archive/1/536390/100/0/threaded · Nota
• http://packetstormsecurity.com/files/133443/Yahoo-Messenger-11.5.0.228-Buffer-Overflow.html · Nota
• http://seclists.org/fulldisclosure/2015/Sep/24 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7216 · Nota de Segurança
• http://securitytracker.com/id/1033544 · Nota
• https://hackerone.com/reports/10767 · Nota