Yahoo IM hit with critical security flaws
222720
Blog: A number of highly critical security flaws have been found in the latest version of Yahoo Messenger, which could allow attackers to gain remote access to users systems.
51466
Yahoo Mail Fixes Security Flaws  Yahoo reportedly fixed two flaws in Yahoo Mail which had the potential to allow a hacker to read a victim's browser cookies and change the appearance of some pages, Yahoo told news services. A Yahoo representative said the flaws were fixed last month by making changes ...
450858
New vulnerabilities include a critical flaw in Internet Explorer and a "major" bug in Firefox.
104614
The Mozilla Project has issued a warning for a series of &quot;highly critical&quot; security holes in three of its core projects, including its flagship Firefox Web browser and the Thunderbird e-mail client.
143342
A vulnerability in Internet Explorer spells potential trouble for Skype users who add or play video in their chats.
406752
A researcher has posted exploit code that attackers can use to hijack Windows machines via Yahoo Inc.'s Messenger instant messaging software.
266813
Aimed at flaws in software that downloads with Messenger, update is called "highly critical" by Yahoo.
468166
Vuln researcher questions company's disclosure practices Yahoo! bug crushers have plugged a serious hole in Yahoo! Messenger that made it possible for bad guys to remotely take control of a user's machine. The update became available less than 24 hours after an anonymous hacker posted proof-of-concept code that demonstrated how the vulnerability could be exploited.â¦
127768
Third-party fix plugs a recently discovered browser flaw that's increasingly being exploited in cyberattacks.
622159
Microsoft is forcing Messenger users to upgrade in order to patch a security vulnerability.
70514
Attackers could bombard PCs using instant messenger's "away" feature. AOL says a fix is imminent.
325298
Webcam! library! peril! ActiveX controls - so often the source of Internet Explorer flaws - are the font of two newly discovered flaws in Yahoo! Messenger.â¦
703212
Security researchers have found a nasty vulnerability in AOL's ICQ Pro 2003b software. AOL is recommendng that users update their software.
662074
(InfoWorld) - Yahoo has fixed a serious vulnerability in its Messenger instant messaging client. The patch, posted Thursday, fixes a critical flaw in the ActiveX control used by Messenger's Webcam feature. According to security experts, this flaw could be exploited by hackers to install unauthorized software on a victim's PC. The patch came after two sample attacks that exploited the vulnerability were posted to the Full Disclosure security discussion list. EEye Digital Security first reported the issue on Wednesday without disclosing specific details of the bug. The security vendor considers the flaw to be serious. "ActiveX remote code execution vulnerabilities have very high impacts because the source of the malicious payload can be any site on the Internet," eEye said in its alert. This is the third time in recent months that Yahoo has had to patch an ActiveX control flaw in Messenger. It patched these other bugs in March and December.
22372
Blog: Yahoo IM fixed after temporary problems
62998
(InfoWorld) - Security researchers Monday disclosed critical vulnerabilities in two popular Windows instant messaging clients, Yahoo Messenger and Trillian. The Yahoo Messenger bug, which was posted to the Full Disclosure mailing list Monday by Rajesh Sethumadhavan, is a buffer overflow flaw that can be exploited with a specially crafted address book entry. Messenger immediately crashes when it encounters the malformed entry, Sethumadhavan said, but it may also be susceptible to code execution, meaning an attacker might be able to inject his own malicious code -- a keystroke stealer or a spam bot, for instance -- into a compromised PC. Yahoo Inc. has not posted a patch for the vulnerability; the company did not immediately respond to a request for confirmation and comment. Trillian, a multiservice client, also sports two bad bugs, said other researchers. A trio made up of Nate Mcfeters, Billy "BK" Rios, and Raghav "The Pope" Dube identified two vulnerabilities in Trillian's handling of the AIM URI (uniform resource identifier). According to Mcfeters, Rios, and Dube, the Trillian flaws are similar to the Internet Explorer/Firefox vulnerability that raised a ruckus last week. "The first example shows the dangers of passing unfiltered arguments to programs that have registered URIs (much like the firefoxurl: vulnerability)," the three wrote in their advisory. "The second example shows that even if arguments are sanitized [emphasis in original] by the browser, many programs can be remotely pwnd via registered URIs and poor development practices." US-CERT posted its own warning Monday as well. The bugs have been confirmed in Trillian 3.1.6.0, added Copenhagen-based vulnerability tracker Secunia APS, which pegged the problems as "highly critical," its second most dire rating. The Web site of Trillian developer Cerulean Studios did not offer an indication that a patch for the Trillian flaw would be forthcoming.
663829
The FrSIRT site has posted a new advisory for users of the Vivvo Article Management CMS software about potential holes that could allow for some very large-scale damage to be done.    Multiple vulnerabilities have been identified in Vivvo Article Management CMS, which could be exploited by remote attackers to compromise a vulnerable server.   The first issue is due to an input validation error in the "pdf_version.php" script that does not validate the "id" parameter before being used in SQL statements, which could be exploited by malicious people to conduct SQL injection attacks.   The second vulnerability is due to an input validation error in the "index.php" script that do not validate the "classified_path" parameter, which may be exploited by remote attackers to include local or remote scripts with the privileges of the web server.    Versions 3.2 and higher of the software are effected, and, unfortunately, there has been no patch issued for the issue.