CVE-2007-4034

Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method. NOTE: some of these details are obtained from third party information.

• CWE-119

• http://help.yahoo.com/l/us/yahoo/widgets/security/security-08.htmlPatch, Vendor Advisory
• http://osvdb.org/37705
• http://secunia.com/advisories/26011Patch, Vendor Advisory
• http://www.kb.cert.org/vuls/id/120760US Government Resource
• http://www.securityfocus.com/bid/25086Exploit, Patch
• http://www.securitytracker.com/id?1018470
• http://www.vupen.com/english/advisories/2007/2679
• http://help.yahoo.com/l/us/yahoo/widgets/security/security-08.htmlPatch, Vendor Advisory
• http://osvdb.org/37705
• http://secunia.com/advisories/26011Patch, Vendor Advisory
• http://www.kb.cert.org/vuls/id/120760US Government Resource
• http://www.securityfocus.com/bid/25086Exploit, Patch
• http://www.securitytracker.com/id?1018470
• http://www.vupen.com/english/advisories/2007/2679

Published

Jul 27, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-4027Buffer overflow in cli32 in Areca CLI 1.72.250 and earlier m…
• CVE-2007-4028Absolute path traversal vulnerability in index.php in Webspe…
• CVE-2007-4029libvorbis 1.1.2, and possibly other versions before 1.2.0, a…
• CVE-2007-4031Directory traversal vulnerability in a certain ActiveX contr…
• CVE-2007-4032Buffer overflow in CrystalPlayer Pro 1.98 allows user-assist…
• CVE-2007-4033Buffer overflow in the intT1_EnvGetCompletePath function in …
• CVE-2007-4035Guidance Software EnCase does not properly handle (1) certai…
• CVE-2007-4036Guidance Software EnCase allows user-assisted remote attacke…
• CVE-2007-4037Guidance Software EnCase allows user-assisted attackers to t…
• CVE-2007-4038Argument injection vulnerability in Mozilla Firefox before 2…
• CVE-2007-4039Argument injection vulnerability involving Mozilla, when cer…9.8
• CVE-2007-4040Argument injection vulnerability involving Microsoft Outlook…8.8