Zero-day flaws strike AIM and Y! Messenger

[Jeff]

Zero-day vulnerabilities were reported today in both AOL Instant Messenger (AIM) and Yahoo! Messenger instant messaging programs, potentially putting millions of IM users at risk.

Alternet has released exploit code for the more serious flaw -- affecting Yahoo! Messenger -- the third major Y! Messenger flaw uncovered in the past two months.

In an apparently unrelated development, security lab Secunia posted an advisory for AOL Instant Messenger that could allow malicious people to remotely execute script code on your computer. The flaw has been confirmed in AIM 6.1.41.2, but other versions may also be affected.

Secunia recommends that AIM users disable notification for when "new IMs arrive" until AOL ships a patch for the flaw.