« Volver al listado

CVE-2006-6603

Estado: ModificadaAlta (9.3)—

Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code via a crafted HTML document. NOTE: some details were obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yahoo — Messenger

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-6603",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-12-15T22:28:00.000",
  "references": [
    {
      "url": "http://messenger.yahoo.com/security_update.php?id=120806",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/23401",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1017387",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/901852",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/21607",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/5016",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://messenger.yahoo.com/security_update.php?id=120806",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/23401",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1017387",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/901852",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/21607",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/5016",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code via a crafted HTML document.  NOTE: some details were obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer en el controlador YMMAPI.YMailAttach ActiveX (ymmapi.dll) anterior a 2005.1.1.4 en Yahoo! Messenger permote a un atacante remoto ejecutar código de su elección a través de un documento HTML manipulado.\r\nNOTA: algunos de estos detalles se han obtenido de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T22:33:26.943",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yahoo:messenger:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DEE11C2-06D7-47AA-8A7B-0063B97E9F58",
              "versionEndIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:yahoo:messenger:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6BF80C1-8F4D-40AF-88FD-D1AFDC03EC6C"
            },
            {
              "criteria": "cpe:2.3:a:yahoo:messenger:5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "349A209F-6609-4809-B228-E84623FA268D"
            },
            {
              "criteria": "cpe:2.3:a:yahoo:messenger:5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92465439-530F-435E-976F-491AD3C56944"
            },
            {
              "criteria": "cpe:2.3:a:yahoo:messenger:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8EE7278-FFAD-489B-BDCC-BF6BA8D5DF0C"
            },
            {
              "criteria": "cpe:2.3:a:yahoo:messenger:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C35A346-6510-44D2-A36E-E6661B6586F3"
            },
            {
              "criteria": "cpe:2.3:a:yahoo:messenger:7.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADE2C978-8812-489D-94F9-186B5519545B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}