AOL vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2010-10015 AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object.High 8.4 · Aug 21, 2025
• CVE-2011-10027 AOL Desktop 9.6 contains a buffer overflow vulnerability in its Tool\rich.rct component when parsing .rtx files.High 8.4 · Aug 20, 2025
• CVE-2009-3658 Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control (sb.dll) in America Online (AOL) 9.5.0.1 allows remote attackers to trigger memory corruptioHigh 8.8 · Oct 9, 2009
• CVE-2007-6250 Stack-based buffer overflow in AOL AOLMediaPlaybackControl (AOLMediaPlaybackControl.exe), as used by AmpX ActiveX control (AmpX.dll), might allow remote attackeHigh 9.3 · Jan 9, 2008
• CVE-2007-5755 Multiple stack-based buffer overflows in the AOL AmpX ActiveX control in AmpX.dll 2.6.1.11 in AOL Radio allow remote attackers to execute arbitrary code via lonHigh 9.3 · Nov 13, 2007
• CVE-2007-3437 AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service (application crash) via a malformed header value in a SIHigh 7.8 · Jun 26, 2007
• CVE-2007-3350 AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service (application hang) via a flood of spoofed SIP INVITE reqHigh 7.8 · Jun 22, 2007
• CVE-2006-5820 The LinkSBIcons method in the SuperBuddy ActiveX control (Sb.SuperBuddy.1) in America Online 9.0 Security Edition dereferences an arbitrary function pointer, whHigh 9.3 · Apr 2, 2007
• CVE-2007-1767 Unspecified vulnerability in (1) Deskbar.dll and (2) Toolbar.dll in AOL 9.0 before February 2007 allows remote attackers to cause a denial of service (browser cHigh 7.8 · Mar 29, 2007
• CVE-2006-6442 Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOLHigh 9.3 · Dec 10, 2006
• CVE-2006-5650 The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent funHigh 7.5 · Nov 7, 2006
• CVE-2006-5501 Buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote attackers tHigh 7.5 · Oct 25, 2006
• CVE-2006-5502 Heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote High 7.5 · Oct 25, 2006
• CVE-2006-3887 Buffer overflow in AOL You've Got Pictures (YGP) Screensaver ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors.High 7.5 · Oct 10, 2006
• CVE-2006-3888 Buffer overflow in AOL You've Got Pictures (YGP) Pic Downloader YGPPDownload ActiveX control (AOL.PicDownloadCtrl.1, YGPPicDownload.dll), as used in America OnlHigh 7.5 · Oct 10, 2006
• CVE-2006-0948 AOL 9.0 Security Edition revision 4184.2340, and probably other versions, uses insecure permissions (Everyone/Full Control) for the "America Online 9.0" directoHigh 7.2 · Aug 21, 2006
• CVE-2006-0526 The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which High 7.2 · Feb 2, 2006
• CVE-2006-0316 Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows High 10 · Jan 18, 2006
• CVE-2005-2597 AOL Client Software 9.0 uses insecure permissions for its installation path, which allows local users to execute arbitrary code with SYSTEM privileges by replacHigh 7.2 · Aug 17, 2005
• CVE-2005-1891 The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed High 7.5 · Jun 9, 2005
• CVE-2004-2373 The Buddy icon file for AOL Instant Messenger (AIM) 4.3 through 5.5 is created in a predictable location, which may allow remote attackers to use a shell: URI tHigh 7.5 · Dec 31, 2004
• CVE-2004-0636 Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to executeHigh 10 · Nov 23, 2004
• CVE-2003-1503 Buffer overflow in AOL Instant Messenger (AIM) 5.2.3292 allows remote attackers to execute arbitrary code via an aim:getfile URL with a long screen name.High 10 · Dec 31, 2003
• CVE-2002-0586 Format string vulnerability in Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows remote High 7.5 · Jun 18, 2002
• CVE-2002-0587 Buffer overflow in Ns_PdLog function for the external database driver proxy daemon library (libnspd.a) of AOLServer 3.0 through 3.4.2 allows remote attackers toHigh 7.5 · Jun 18, 2002