PT-2007-4102 · Sun · Java Development Kit+1

Published 2007-05-22 · Updated 2019-08-01 · CVE-2007-2788

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java Development Kit (JDK) versions 1.3.1 through 1.5.0 10 Sun Java Development Kit (JDK) versions 1.6.x prior to 1.6.0 01-b06 Sun Java Runtime Environment (JRE) versions 1.3.1 through 1.5.0 10 Sun Java Runtime Environment (JRE) versions 1.6.x prior to 1.6.0 01-b06

Description The issue is caused by an integer overflow in the embedded ICC profile image parser, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted JPEG or BMP file that triggers a buffer overflow.

Recommendations For Sun Java Development Kit (JDK) versions 1.3.1 through 1.5.0 10, update to version 1.5.0 11-b03 or later. For Sun Java Development Kit (JDK) versions 1.6.x prior to 1.6.0 01-b06, update to version 1.6.0 01-b06 or later. For Sun Java Runtime Environment (JRE) versions 1.3.1 through 1.5.0 10, update to version 1.5.0 11-b03 or later. For Sun Java Runtime Environment (JRE) versions 1.6.x prior to 1.6.0 01-b06, update to version 1.6.0 01-b06 or later.

Exploit

Fix

RCE

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2007-2788

RHSA-2007:0817

RHSA-2007:0829

RHSA-2007:0956

RHSA-2007:1086

RHSA-2008:0100

RHSA-2008:0261

RHSA-2008:0524

Affected Products

Java Development Kit

Sun Java Runtime Environment

References · 61

• 🔥 https://exploit-db.com/exploits/30043 · Exploit
• http://secunia.com/advisories/25295 · Patch
• http://gentoo.org/security/en/glsa/glsa-200709-15.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2788 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-1086.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200705-23.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0956.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0829.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102934-1 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/248 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_45_java.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0817.html · Vendor Advisory