CVE-2007-2788

Description

Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.

Category

6.8
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 53.68% Top 5%
Vendor Advisory bea.com Vendor Advisory sun.com Vendor Advisory gentoo.org Vendor Advisory gentoo.org Vendor Advisory sun.com Vendor Advisory novell.com Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory novell.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://secunia.com/advisories/26933 third party advisory
http://docs.info.apple.com/article.html?artnum=307177 broken link
http://lists.vmware.com/pipermail/security-announce/2008/000003.html third party advisory mailing list
http://secunia.com/advisories/26049 third party advisory
http://dev2dev.bea.com/pub/advisory/248 third party advisory vendor advisory
http://secunia.com/advisories/26311 third party advisory
http://www.attrition.org/pipermail/vim/2007-July/001696.html third party advisory mailing list
https://exchange.xforce.ibmcloud.com/vulnerabilities/34652 vdb entry third party advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200856-1 vendor advisory broken link
http://scary.beasts.org/security/CESA-2006-004.html third party advisory
http://secunia.com/advisories/30805 third party advisory
http://www.vupen.com/english/advisories/2008/0065 vdb entry permissions required
https://exchange.xforce.ibmcloud.com/vulnerabilities/34318 vdb entry third party advisory
http://www.kb.cert.org/vuls/id/138545 third party advisory us government resource
http://www.gentoo.org/security/en/glsa/glsa-200705-23.xml third party advisory vendor advisory
http://www.securityfocus.com/bid/24004 vdb entry third party advisory
http://www.attrition.org/pipermail/vim/2007-December/001862.html third party advisory mailing list
http://secunia.com/advisories/26369 third party advisory
http://security.gentoo.org/glsa/glsa-200804-28.xml third party advisory vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102934-1 vendor advisory broken link
http://secunia.com/advisories/28056 third party advisory
http://secunia.com/advisories/29858 third party advisory
http://www.novell.com/linux/security/advisories/2007_45_java.html third party advisory vendor advisory
http://www.vupen.com/english/advisories/2007/1836 vdb entry permissions required
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html mailing list third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-0100.html third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0956.html third party advisory vendor advisory
http://support.novell.com/techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.html third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0817.html third party advisory vendor advisory
http://secunia.com/advisories/26645 third party advisory
http://secunia.com/advisories/26119 third party advisory
http://secunia.com/advisories/28365 third party advisory
http://www.securityfocus.com/bid/24267 vdb entry third party advisory
http://secunia.com/advisories/25832 third party advisory
http://www.vupen.com/english/advisories/2007/4224 vdb entry permissions required
http://security.gentoo.org/glsa/glsa-200706-08.xml third party advisory vendor advisory
http://secunia.com/advisories/30780 third party advisory
http://secunia.com/advisories/25295 third party advisory patch
http://www.vupen.com/english/advisories/2007/3009 vdb entry permissions required
http://secunia.com/advisories/27266 third party advisory
http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html third party advisory vendor advisory
http://www.attrition.org/pipermail/vim/2007-July/001708.html third party advisory mailing list
http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml third party advisory vendor advisory
http://secunia.com/advisories/28115 third party advisory
http://www.securitytracker.com/id?1018182 vdb entry third party advisory
http://www.redhat.com/support/errata/RHSA-2008-0261.html third party advisory vendor advisory
http://secunia.com/advisories/29340 third party advisory
http://secunia.com/advisories/25474 third party advisory
http://www.redhat.com/support/errata/RHSA-2007-1086.html third party advisory vendor advisory
http://secunia.com/advisories/27203 third party advisory
http://www.attrition.org/pipermail/vim/2007-July/001697.html third party advisory mailing list
http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml third party advisory vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml third party advisory vendor advisory
http://support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.html third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0829.html third party advisory vendor advisory
http://secunia.com/advisories/26631 third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11700 vdb entry third party advisory signature
http://www.redhat.com/support/errata/RHSA-2008-0133.html third party advisory vendor advisory

Frequently Asked Questions

What is the severity of CVE-2007-2788?
CVE-2007-2788 has been scored as a medium severity vulnerability.
How to fix CVE-2007-2788?
To fix CVE-2007-2788, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-2788 being actively exploited in the wild?
It is possible that CVE-2007-2788 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~54% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.