Format string vulnerability in the embedded Internet Explorer component for Mirabilis ICQ 6 build 6043 allows remote servers to execute arbitrary code or cause a denial of service (crash) via unspecified vectors related to HTML code generation.
http://www.vupen.com/english/advisories/2008/0701
http://www.securityfocus.com/bid/28027