CVE-2007-4391: Buffer Overflow

Published Aug 17, 2007

Updated

Heap-based buffer overflow in Kakadu kduv32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then injecting a DLL into the attacker's peer Yahoo! Messenger application when this request is accepted.

Affected Software

1 affected component

Yahoo Messenger=8.1.0.413

Event History

Aug 17, 2007

CVE Published

10:17 PM

Aug 18, 2007

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4391?

CVE-2007-4391 is considered a high severity vulnerability as it can cause a denial of service by crashing Yahoo! Messenger.

How do I fix CVE-2007-4391?

To mitigate CVE-2007-4391, users are advised to upgrade to a patched version of Yahoo! Messenger or remove the vulnerable software.

What software is affected by CVE-2007-4391?

CVE-2007-4391 specifically affects Yahoo! Messenger version 8.1.0.413.

What kind of attack exploits CVE-2007-4391?

CVE-2007-4391 can be exploited through a specially crafted JPEG2000 data stream which triggers a heap-based buffer overflow.

What are the potential impacts of CVE-2007-4391?

The potential impacts of CVE-2007-4391 include application crashes and possible remote code execution if further exploited.