CVE-2007-4391 Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as...
HighCVSS 9.3
EPSS 9.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then injecting a DLL into the attacker's peer Yahoo! Messenger application when this request is accepted.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yahoo messenger | = 8.1.0.413 | No fix listed |
References
- 38221 vdb-entry
- 26501 third-party-advisory
- www.avertlabs.com
- VU#515968 third-party-advisory us-government-resource
- 25330 vdb-entry
- 1018586 vdb-entry
- www.team509.com
- ADV-2007-2917 vdb-entry
- yahoo-messenger-webcam-bo(36115) vdb-entry
- www.xfocus.net