PT-2015-3915 · Yahoo · Yahoo! Messenger

Julien Ahrens · Published 2015-09-11 · Updated 2018-10-09 · CVE-2014-7216

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 11.5.0.228 and earlier

Description The issue is related to multiple stack-based buffer overflows that can be triggered by remote attackers. This can lead to a denial of service, causing the application to crash, and potentially allow the execution of arbitrary code. The overflows can occur via the shortcut or title keys in an emoticons.xml file.

Recommendations For Yahoo! Messenger versions 11.5.0.228 and earlier, update to a version later than 11.5.0.228 to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-7216

Affected Products

Yahoo! Messenger

References · 7

• 🔥 https://rcesecurity.com/2015/09/cve-2014-7216-a-journey-through-yahoos-bug-bounty-program · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-7216 · Security Note
• http://securityfocus.com/archive/1/536390/100/0/threaded · Note
• http://packetstormsecurity.com/files/133443/Yahoo-Messenger-11.5.0.228-Buffer-Overflow.html · Note
• http://seclists.org/fulldisclosure/2015/Sep/24 · Note
• http://securitytracker.com/id/1033544 · Note
• https://hackerone.com/reports/10767 · Note