NetSight
IP …
critical9.3Public exploit code

CVE-2007-4391

Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo!

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then injecting a DLL into the attacker's peer Yahoo! Messenger application when this request is accepted.

Affected products

VendorProductAffected versions
YahooMessenger
Version 8.1.0.413

Weakness classification

CWE-20CWE-119

References