Secunia

Some vulnerabilities have been reported in AOL, which can be exploited by malicious people to compromise a user's system.

1 ) Unspecified boundary errors within the AOL YGP (You've Got Pictures) Screensaver and the AOL YGP (You've Got Pictures) Pic Downloader ActiveX controls can be exploited to cause a buffer overflow when e.g. visiting a malicious website.

2) A boundary error within the "SetAlbumName()" method of the AOL YGP (You've Got Pictures) Pic Downloader ActiveX control can be exploited to cause a buffer overflow when e.g. visiting a malicious website.

Successful exploitation may allow execution of arbitrary code.

Solution
Updates are automatically available by logging into the AOL service.

Provided and/or discovered by
1) Will Dormann, CERT/CC.
2) Discovered by an anonymous person and reported via iDefense Labs.

Changelog
Further details available in Customer Area

Original Advisory
US-CERT VU#154641:
http://www.kb.cert.org/vuls/id/154641

US-CERT VU#661524:
http://www.kb.cert.org/vuls/id/661524

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=420

Deep Links
Links available in Customer Area