source: http://www.securityfocus.com/bid/25086/info
Yahoo! Widgets Engine is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
Yahoo! Widgets Engine 4.0.3 (build 178) is reported vulnerable; other versions may be affected as well.