Core Security Technologies Advisory - Remote command execution, HTML and JavaScript injection vulnerabilities in AOL's Instant Messaging software. Versions 6.1, 6.2, Pro, and Lite are affected.
The GDI engine in Windows Live Messenger suffers from a malformed file overflow when handling specially crafted JPG/WMF/GIF/DOC/ICO files. Details on remote exploitation included.
Trend Micro ServerProtect remote stack overflow exploit that takes advantage of a boundary error condition within eng50.dll via a specially crafted RPC request to the SpntSvc.exe service. Binds a shell to TCP port 4444.