A 'highly critical' vulnerability has been discovered in Yahoo Widgets that could allow a remote attacker to run code on a user's PC.
The vulnerability is caused by a boundary error within the YDPCTL.dll ActiveX control when handling the 'GetComponentVersion()' method.
Passing a string greater than 512-bytes through an affected system could cause a stack-based buffer overflow.
Successful exploitation of the flaw would then allow arbitrary code to be executed on the system.
The vulnerability is confirmed in YDPCTL.dll version 2007.4.13.1 in Yahoo Widgets version 4.0.3, also known as 'build 178'.
However, security firm Secunia, which rated the flaw as 'highly critical', said that other versions of Yahoo Widgets may also be affected.
Users can fix the flaw manually by downloading the latest update from the Yahoo Widgets website and updating the software to version 4.0.5.
"Over the next several weeks users worldwide will be prompted to update to a new version of Yahoo Widgets on launching the application," a Yahoo security advisory said. "If you choose not to update, the vulnerability will still exist."
Yahoo Widgets are software plug-ins that allow information to be delivered to a user's desktop, including weather reports, games, radio, scoreboards, calendars and "just about anything you can imagine".
New light-guiding nanoscale device can control and monitor a nanoparticle trapped in a laser beam with high sensitivity
Optical traps are scientific instruments in which a focused laser beam is used to exert an attractive or repulsive force on a microscopic object to hold it in place
Scientists estimate that the exoplanet has already lost up to 35 per cent of its mass over its lifetime
The observations were made using the Atacama Array in the Chilean desert
J1043+2408 was observed for more than 10 years, and its radio light curve exhibited a periodic signal repeating in about 563 days