Critical flaw hits Yahoo Widgets

By

A 'highly critical' vulnerability has been discovered in Yahoo Widgets that could allow a remote attacker to run code on a user's PC.

Critical flaw hits Yahoo Widgets
The vulnerability is caused by a boundary error within the YDPCTL.dll ActiveX control when handling the 'GetComponentVersion()' method.

Passing a string greater than 512-bytes through an affected system could cause a stack-based buffer overflow.

Successful exploitation of the flaw would then allow arbitrary code to be executed on the system.

The vulnerability is confirmed in YDPCTL.dll version 2007.4.13.1 in Yahoo Widgets version 4.0.3, also known as 'build 178'.

However, security firm Secunia, which rated the flaw as 'highly critical', said that other versions of Yahoo Widgets may also be affected. 

Users can fix the flaw manually by downloading the latest update from the Yahoo Widgets website and updating the software to version 4.0.5. 

"Over the next several weeks users worldwide will be prompted to update to a new version of Yahoo Widgets on launching the application," a Yahoo security advisory said. "If you choose not to update, the vulnerability will still exist." 

Yahoo Widgets are software plug-ins that allow information to be delivered to a user's desktop, including weather reports, games, radio, scoreboards, calendars and "just about anything you can imagine".
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

Service NSW centralises security, networking in mammoth CloudOps overhaul

Service NSW centralises security, networking in mammoth CloudOps overhaul

VicRoads to phase out passwords in favour of passkeys

VicRoads to phase out passwords in favour of passkeys

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

Log In

  |  Forgot your password?