News 

Secunia reports that the flaw, discovered by Ryan McGeehan, may allow execution of arbitrary code on a user's system when, for example, a malicious website is visited with certain browsers.

'The vulnerability is caused due to a boundary error within the handling of "Away" messages and can be exploited to cause a stack-based buffer overflow by supplying an overly long "Away" message (about 1,024 bytes). A malicious website can exploit this via the "aim:" URL handler by passing an overly long argument to the "goaway?message" parameter.'

The vulnerability has been confirmed in version 5.5.3595 but other versions may also be affected.

Secunia adds that various other issues were also reported, where a large amount of resources can be consumed on a user's system. AOL was contacted but has not responded.