CVE-2011-0487 ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism.
HighCVSS 9.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| icq | = 7 | No fix listed |
References
- 70486 vdb-entry
- VU#680540 third-party-advisory us-government-resource
- 20110114 Remote Code Execution in ICQ 7 mailing-list
- 45805 vdb-entry
- icq-updates-code-execution(64711) vdb-entry