CVE-2006-5820 EXPLOIT
9.3
HIGH · CVSS 2.0 · EPSS 8.4% (pctl 95)
Patch early
A public exploit exists.
Description
The LinkSBIcons method in the SuperBuddy ActiveX control (Sb.SuperBuddy.1) in America Online 9.0 Security Edition dereferences an arbitrary function pointer, which allows remote attackers to execute arbitrary code via a modified pointer value.
Scoring
| CVSS | 9.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| EPSS | 8.43% — more likely to be exploited than 95% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-04-02 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| aol | aol |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | AOL SuperBuddy - ActiveX Control Remote Code Execution (Metasploit) | 2007-04-04 |
References
- http://osvdb.org/34318
- http://secunia.com/advisories/24714
- http://securityreason.com/securityalert/2513
- http://www.kb.cert.org/vuls/id/478225
- http://www.securityfocus.com/archive/1/464313/100/0/threaded
- http://www.securityfocus.com/bid/23224
- http://www.tippingpoint.com/security/advisories/TSRT-07-03.html
- http://www.vupen.com/english/advisories/2007/1184
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33347
- http://osvdb.org/34318
- http://secunia.com/advisories/24714
- http://securityreason.com/securityalert/2513
- http://www.kb.cert.org/vuls/id/478225
- http://www.securityfocus.com/archive/1/464313/100/0/threaded
- http://www.securityfocus.com/bid/23224
- http://www.tippingpoint.com/security/advisories/TSRT-07-03.html
- http://www.vupen.com/english/advisories/2007/1184
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33347
→ the Explorer · watch your stack · NVD