vulnwire
4.3med

CVE-2007-2789

The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
0
none known

The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.

Exploit prediction (EPSS)

3.48% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

References

  • secunia.com /advisories/26933 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • docs.info.apple.com /article.html?artnum=307177 · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34654 · vdb-entry, x_refsource_XF, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10800 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • secunia.com /advisories/26049 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • dev2dev.bea.com /pub/advisory/248 · vendor-advisory, x_refsource_BEA, x_transferred
  • secunia.com /advisories/26311 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • attrition.org /pipermail/vim/2007-July/001696.html · mailing-list, x_refsource_VIM, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-66-200856-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • scary.beasts.org /security/CESA-2006-004.html · x_refsource_MISC, x_transferred
  • secunia.com /advisories/30805 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • gentoo.org /security/en/glsa/glsa-200705-23.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityfocus.com /bid/24004 · vdb-entry, x_refsource_BID, x_transferred
  • attrition.org /pipermail/vim/2007-December/001862.html · mailing-list, x_refsource_VIM, x_transferred
  • secunia.com /advisories/26369 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • security.gentoo.org /glsa/glsa-200804-28.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-102934-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • secunia.com /advisories/28056 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29858 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • novell.com /linux/security/advisories/2007_45_java.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • vupen.com /english/advisories/2007/1836 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34320 · vdb-entry, x_refsource_XF, x_transferred
  • lists.apple.com /archives/Security-announce/2007/Dec/msg00001.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • redhat.com /support/errata/RHSA-2008-0100.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • redhat.com /support/errata/RHSA-2007-0956.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • support.novell.com /techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.html · x_refsource_CONFIRM, x_transferred
  • redhat.com /support/errata/RHSA-2007-0817.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/26645 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/26119 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/25832 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/4224 · vdb-entry, x_refsource_VUPEN, x_transferred
  • security.gentoo.org /glsa/glsa-200706-08.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • secunia.com /advisories/30780 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/25295 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/3009 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/27266 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • novell.com /linux/security/advisories/2007_56_ibmjava.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • attrition.org /pipermail/vim/2007-July/001708.html · mailing-list, x_refsource_VIM, x_transferred
  • gentoo.org /security/en/glsa/glsa-200709-15.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • secunia.com /advisories/28115 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/25474 · Third Party Advisory
  • secunia.com /advisories/26631 · Third Party Advisory
  • secunia.com /advisories/27203 · Third Party Advisory
  • secunia.com /advisories/29340 · Third Party Advisory
  • support.novell.com /techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.html · Third Party Advisory
  • attrition.org /pipermail/vim/2007-July/001697.html · Third Party Advisory
  • gentoo.org /security/en/glsa/glsa-200804-20.xml · Third Party Advisory
  • gentoo.org /security/en/glsa/glsa-200806-11.xml · Third Party Advisory
  • redhat.com /support/errata/RHSA-2007-0829.html · Third Party Advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.