PT-2012-2450 · Yahoo · Yahoo! Messenger
Published
2012-01-19
·
Updated
2012-01-23
·
CVE-2012-0268
CVSS v2.0
5.1
Medium
| Vector | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Yahoo! Messenger versions prior to 11.5.0.155
Description
The issue is related to an integer overflow in the CYImage::LoadJPG method within the YImage.dll component of Yahoo! Messenger. This occurs when photo sharing is enabled and a crafted JPG image is used, potentially triggering a heap-based buffer overflow. This could allow remote attackers to execute arbitrary code.
Recommendations
For versions prior to 11.5.0.155, update to version 11.5.0.155 or later to resolve the issue. As a temporary workaround, consider disabling photo sharing until the update is applied.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Yahoo! Messenger