CVE-2007-4901: Medium severity AOL AIM Lite vulnerability
The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4901?
CVE-2007-4901 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2007-4901?
To address CVE-2007-4901, users should update their AOL Instant Messenger to the latest version or uninstall affected versions.
What software is affected by CVE-2007-4901?
CVE-2007-4901 affects AOL Instant Messenger versions 6.1.41.2, 6.2.32.1, AIM Pro, and AIM Lite.
What type of vulnerability is CVE-2007-4901?
CVE-2007-4901 is classified as a remote code execution vulnerability stemming from improper constraints in handling HTML and script functionality.
Can CVE-2007-4901 be exploited remotely?
Yes, CVE-2007-4901 can be exploited remotely by attackers sending specially crafted messages to affected users.