PT-2015-3915

CVE-2014-7216

Published

2015-09-11

Updated

2018-10-09

Description by

CVSS 2.0

9.3

High

MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 11.5.0.228 and earlier

Description The issue is related to multiple stack-based buffer overflows that can be triggered by remote attackers. This can lead to a denial of service, causing the application to crash, and potentially allow the execution of arbitrary code. The overflows can occur via the shortcut or title keys in an emoticons.xml file.

Recommendations For Yahoo! Messenger versions 11.5.0.228 and earlier, update to a version later than 11.5.0.228 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Julien Ahrens

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers