Some vulnerabilities have been discovered in Amaya, which can be exploited by malicious people to compromise a user's system.

1) A boundary error when processing "<div>" HTML tags can be exploited to cause a stack-based buffer overflow via an overly long "id" parameter.

2) A boundary error exists when processing overly long links. This can be exploited to cause a stack-based buffer overflow by tricking the user into e.g. editing a malicious link.

3) A boundary error when processing e.g. a "<bdo>" HTML tag having an overly long "dir" attribute can be exploited to cause a stack-based buffer overflow.

4) A boundary error when processing "<input>" HTML tags can be exploited to cause a stack-based buffer overflow via an overly long e.g. "type" attribute..

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

The vulnerabilities are confirmed in version 11.0.1 for Windows. Other versions may also be affected.

Solution
Do not follow untrusted links or browse untrusted websites.

Provided and/or discovered by
1, 2) r0ut3r
3) webDEViL
4) Dan Crowley and Alfredo Ortega, Core Security Technologies

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) http://www.bmgsec.com.au/advisory/41/
2) http://www.bmgsec.com.au/advisory/40/
3) http://milw0rm.com/exploits/7467
4) http://www.coresecurity.com/content/amaya-buffer-overflows

Deep Links
Links available to Secunia VIM customers