AOL You"ve Got Pictures ActiveX buffer overflow

aol-youvegotpictures-activex-bo (24160) The risk level is classified as HighHigh Risk


The AOL You've Got Pictures component in AOL is vulnerable to a buffer overflow in the AOL YGP Picture Finder Tool ActiveX control (YGPPicFinder.dll). By creating a malicious Web page that invokes the affected ActiveX control and persuading a user to visit the page, a remote attacker could overflow a buffer and cause the victim's Web browser to crash or execute arbitrary code on the victim's system.

Note: This vulnerability also affects the YGPPicFinder.dll ActiveX control that was distributed on the You've Got Pictures Web site prior to 2004.


Gain Access


Upgrade to AOL 9.0 Optimized or AOL 9.0 Security Edition.


Apply the hotfix (YPGClean.exe) for this issue, available from the AOL Download Web site. See References.


  • AOL Dowload Web site: Index of /security.
  • AOL Web site: - Welcome to America Online.
  • BID-16262: AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
  • CVE-2006-0316: Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors.
  • OSVDB ID: 22486: America OnLine (AOL) YPG Picture Finder Tool ActiveX Control (YGPPicFinder.DLL) Overflow
  • SA18521: AOL You`ve Got Pictures ActiveX Control Buffer Overflow
  • SECTRACK ID: 1015494: AOL Buffer Overflow in You`ve Got Pictures ActiveX Control Lets Remote Users Execute Arbitrary Code
  • US-CERT VU#715730: AOL You`ve Got Pictures ActiveX control buffer overflow

Platforms Affected:

  • AOL AOL 8.0
  • AOL AOL 8.0 Plus
  • AOL AOL 9.0 Classic


Jan 16, 2006

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this

Return to the main page