CVE-2007-4034 EXPLOIT
9.3
HIGH · CVSS 2.0 · EPSS 13% (pctl 96)
Patch early
A public exploit exists.
Description
Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method. NOTE: some of these details are obtained from third party information.
Scoring
| CVSS | 9.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| EPSS | 12.96% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-07-27 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| yahoo | widgets |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Yahoo! Widget < 4.0.5 - 'GetComponentVersion()' Remote Overflow | 2007-07-31 |
References
- http://help.yahoo.com/l/us/yahoo/widgets/security/security-08.html
- http://osvdb.org/37705
- http://secunia.com/advisories/26011
- http://www.kb.cert.org/vuls/id/120760
- http://www.securityfocus.com/bid/25086
- http://www.securitytracker.com/id?1018470
- http://www.vupen.com/english/advisories/2007/2679
- http://help.yahoo.com/l/us/yahoo/widgets/security/security-08.html
- http://osvdb.org/37705
- http://secunia.com/advisories/26011
- http://www.kb.cert.org/vuls/id/120760
- http://www.securityfocus.com/bid/25086
- http://www.securitytracker.com/id?1018470
- http://www.vupen.com/english/advisories/2007/2679
→ the Explorer · watch your stack · NVD