Critical flaw hits Yahoo Widgets

By

A 'highly critical' vulnerability has been discovered in Yahoo Widgets that could allow a remote attacker to run code on a user's PC.

Critical flaw hits Yahoo Widgets
The vulnerability is caused by a boundary error within the YDPCTL.dll ActiveX control when handling the 'GetComponentVersion()' method.

Passing a string greater than 512-bytes through an affected system could cause a stack-based buffer overflow.

Successful exploitation of the flaw would then allow arbitrary code to be executed on the system.

The vulnerability is confirmed in YDPCTL.dll version 2007.4.13.1 in Yahoo Widgets version 4.0.3, also known as 'build 178'.

However, security firm Secunia, which rated the flaw as 'highly critical', said that other versions of Yahoo Widgets may also be affected. 

Users can fix the flaw manually by downloading the latest update from the Yahoo Widgets website and updating the software to version 4.0.5. 

"Over the next several weeks users worldwide will be prompted to update to a new version of Yahoo Widgets on launching the application," a Yahoo security advisory said. "If you choose not to update, the vulnerability will still exist." 

Yahoo Widgets are software plug-ins that allow information to be delivered to a user's desktop, including weather reports, games, radio, scoreboards, calendars and "just about anything you can imagine".
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?