PT-2025-34284 · America Online · Phobos.Dll+3

Published 2025-08-21 · Updated 2025-08-21 · CVE-2010-10015

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: AOL versions prior to 9.6

Description: AOL versions up to and including 9.5 include an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attackers to execute arbitrary code in the context of the user, but only when a malicious HTML file is opened locally, as the control is not marked as safe for scripting or initialization. AOL remains an active brand offering services like AOL Mail and AOL Desktop Gold, but the legacy AOL 9.5 desktop software—specifically the version containing the vulnerable Phobos.dll ActiveX control—is discontinued and no longer maintained.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2010-10015

Affected Products

Aol 9.5

Aol 9.6

Aol Desktop Gold

Phobos.Dll

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2010-10015 · Security Note
• http://exploit-db.com/exploits/11190 · Note
• https://fortiguard.com/encyclopedia/ips/32026/aol-phobos-dll-activex-control-import-buffer-overflow · Note
• https://broadcom.com/support/security-center/attacksignatures/detail?asid=26569 · Note
• https://exploit-db.com/exploits/11190 · Note
• https://appdb.winehq.org/objectManager.php?sClass=version&iId=20354 · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/aol_phobos_bof.rb · Note
• https://exploit-db.com/exploits/11204 · Note
• https://web.archive.org/web/20100804162117/http://rec-sec.com/2010/01/25/aol-playlist-class-buffer-overflow · Note
• https://t.me/cveNotify/133104 · Telegram Post
• https://vulncheck.com/advisories/aol-phobos-playlist-import-stack-based-buffer-overflow · Note