CVE-2007-2789

BMP image parser vulnerability

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.

El analizador de imágenes BMP en Sun Java Development Kit (JDK) versiones anteriores a 1.5.0_11-b03 y versiones 1.6.x anteriores a 1.6.0_01-b06, y Sun Java Runtime Environment en JDK y JRE versión 6, JDK y JRE versión 5.0 Update 10 y anteriores, SDK y JRE versión 1.4.2_14 y anteriores, y SDK y JRE versión 1.3.1_19 y anteriores, cuando se ejecutan en sistemas Unix/Linux, permiten a atacantes remotos causar una denegación de servicio (bloqueo de JVM) por medio de applets o aplicaciones no confiables que abren archivos locales arbitrarios por medio de un archivo BMP diseñado, tales como /dev/tty.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-05-21 CVE Reserved
2007-05-22 CVE Published
2024-07-17 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-399: Resource Management Errors

CAPEC

References (52)

URL	Tag	Source
http://docs.info.apple.com/article.html?artnum=307177	Broken Link
http://scary.beasts.org/security/CESA-2006-004.html	Third Party Advisory
http://secunia.com/advisories/25474	Third Party Advisory
http://secunia.com/advisories/25832	Third Party Advisory
http://secunia.com/advisories/26049	Third Party Advisory
http://secunia.com/advisories/26119	Third Party Advisory
http://secunia.com/advisories/26311	Third Party Advisory
http://secunia.com/advisories/26369	Third Party Advisory
http://secunia.com/advisories/26631	Third Party Advisory
http://secunia.com/advisories/26645	Third Party Advisory
http://secunia.com/advisories/26933	Third Party Advisory
http://secunia.com/advisories/27203	Third Party Advisory
http://secunia.com/advisories/27266	Third Party Advisory
http://secunia.com/advisories/28056	Third Party Advisory
http://secunia.com/advisories/28115	Third Party Advisory
http://secunia.com/advisories/29340	Third Party Advisory
http://secunia.com/advisories/29858	Third Party Advisory
http://secunia.com/advisories/30780	Third Party Advisory
http://secunia.com/advisories/30805	Third Party Advisory
http://support.novell.com/techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.html	Third Party Advisory
http://support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.html	Third Party Advisory
http://www.attrition.org/pipermail/vim/2007-December/001862.html	Mailing List
http://www.attrition.org/pipermail/vim/2007-July/001696.html	Mailing List
http://www.attrition.org/pipermail/vim/2007-July/001697.html	Mailing List
http://www.attrition.org/pipermail/vim/2007-July/001708.html	Mailing List
http://www.securityfocus.com/bid/24004	Third Party Advisory
http://www.securitytracker.com/id?1018182	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/34320	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/34654	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10800	Signature

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/25295	2019-08-01

URL	Date	SRC
http://dev2dev.bea.com/pub/advisory/248	2019-08-01
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html	2019-08-01
http://security.gentoo.org/glsa/glsa-200706-08.xml	2019-08-01
http://security.gentoo.org/glsa/glsa-200804-28.xml	2019-08-01
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102934-1	2019-08-01
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200856-1	2019-08-01
http://www.gentoo.org/security/en/glsa/glsa-200705-23.xml	2019-08-01
http://www.gentoo.org/security/en/glsa/glsa-200709-15.xml	2019-08-01
http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml	2019-08-01
http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml	2019-08-01
http://www.novell.com/linux/security/advisories/2007_45_java.html	2019-08-01
http://www.novell.com/linux/security/advisories/2007_56_ibmjava.html	2019-08-01
http://www.redhat.com/support/errata/RHSA-2007-0817.html	2019-08-01
http://www.redhat.com/support/errata/RHSA-2007-0829.html	2019-08-01
http://www.redhat.com/support/errata/RHSA-2007-0956.html	2019-08-01
http://www.redhat.com/support/errata/RHSA-2007-1086.html	2019-08-01
http://www.redhat.com/support/errata/RHSA-2008-0100.html	2019-08-01
http://www.redhat.com/support/errata/RHSA-2008-0133.html	2019-08-01
http://www.redhat.com/support/errata/RHSA-2008-0261.html	2019-08-01
https://access.redhat.com/security/cve/CVE-2007-2789	2008-06-30
https://bugzilla.redhat.com/show_bug.cgi?id=250729	2008-06-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		-		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update1		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update10		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update2		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update3		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update4		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update5		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update6		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update7		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update8		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.5.0 Search vendor "Sun" for product "Jdk" and version "1.5.0"		update9		Affected
Sun Search vendor "Sun"		Jdk Search vendor "Sun" for product "Jdk"				1.6.0 Search vendor "Sun" for product "Jdk" and version "1.6.0"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1 Search vendor "Sun" for product "Jre" and version "1.3.1"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_2 Search vendor "Sun" for product "Jre" and version "1.3.1_2"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_03 Search vendor "Sun" for product "Jre" and version "1.3.1_03"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_04 Search vendor "Sun" for product "Jre" and version "1.3.1_04"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_05 Search vendor "Sun" for product "Jre" and version "1.3.1_05"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_06 Search vendor "Sun" for product "Jre" and version "1.3.1_06"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_07 Search vendor "Sun" for product "Jre" and version "1.3.1_07"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_08 Search vendor "Sun" for product "Jre" and version "1.3.1_08"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_09 Search vendor "Sun" for product "Jre" and version "1.3.1_09"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_10 Search vendor "Sun" for product "Jre" and version "1.3.1_10"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_11 Search vendor "Sun" for product "Jre" and version "1.3.1_11"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_12 Search vendor "Sun" for product "Jre" and version "1.3.1_12"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_13 Search vendor "Sun" for product "Jre" and version "1.3.1_13"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_14 Search vendor "Sun" for product "Jre" and version "1.3.1_14"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_15 Search vendor "Sun" for product "Jre" and version "1.3.1_15"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_16 Search vendor "Sun" for product "Jre" and version "1.3.1_16"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_17 Search vendor "Sun" for product "Jre" and version "1.3.1_17"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_18 Search vendor "Sun" for product "Jre" and version "1.3.1_18"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.3.1_19 Search vendor "Sun" for product "Jre" and version "1.3.1_19"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2 Search vendor "Sun" for product "Jre" and version "1.4.2"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_1 Search vendor "Sun" for product "Jre" and version "1.4.2_1"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_2 Search vendor "Sun" for product "Jre" and version "1.4.2_2"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_3 Search vendor "Sun" for product "Jre" and version "1.4.2_3"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_4 Search vendor "Sun" for product "Jre" and version "1.4.2_4"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_5 Search vendor "Sun" for product "Jre" and version "1.4.2_5"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_6 Search vendor "Sun" for product "Jre" and version "1.4.2_6"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_7 Search vendor "Sun" for product "Jre" and version "1.4.2_7"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_8 Search vendor "Sun" for product "Jre" and version "1.4.2_8"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_9 Search vendor "Sun" for product "Jre" and version "1.4.2_9"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_10 Search vendor "Sun" for product "Jre" and version "1.4.2_10"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_11 Search vendor "Sun" for product "Jre" and version "1.4.2_11"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_12 Search vendor "Sun" for product "Jre" and version "1.4.2_12"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_13 Search vendor "Sun" for product "Jre" and version "1.4.2_13"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.4.2_14 Search vendor "Sun" for product "Jre" and version "1.4.2_14"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		-		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update1		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update10		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update2		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update3		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update4		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update5		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update6		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update7		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update8		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.5.0 Search vendor "Sun" for product "Jre" and version "1.5.0"		update9		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				1.6.0 Search vendor "Sun" for product "Jre" and version "1.6.0"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1 Search vendor "Sun" for product "Sdk" and version "1.3.1"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_01 Search vendor "Sun" for product "Sdk" and version "1.3.1_01"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_01a Search vendor "Sun" for product "Sdk" and version "1.3.1_01a"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_02 Search vendor "Sun" for product "Sdk" and version "1.3.1_02"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_03 Search vendor "Sun" for product "Sdk" and version "1.3.1_03"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_04 Search vendor "Sun" for product "Sdk" and version "1.3.1_04"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_05 Search vendor "Sun" for product "Sdk" and version "1.3.1_05"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_06 Search vendor "Sun" for product "Sdk" and version "1.3.1_06"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_07 Search vendor "Sun" for product "Sdk" and version "1.3.1_07"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_08 Search vendor "Sun" for product "Sdk" and version "1.3.1_08"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_09 Search vendor "Sun" for product "Sdk" and version "1.3.1_09"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_10 Search vendor "Sun" for product "Sdk" and version "1.3.1_10"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_11 Search vendor "Sun" for product "Sdk" and version "1.3.1_11"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_12 Search vendor "Sun" for product "Sdk" and version "1.3.1_12"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_13 Search vendor "Sun" for product "Sdk" and version "1.3.1_13"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_14 Search vendor "Sun" for product "Sdk" and version "1.3.1_14"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_15 Search vendor "Sun" for product "Sdk" and version "1.3.1_15"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_16 Search vendor "Sun" for product "Sdk" and version "1.3.1_16"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_17 Search vendor "Sun" for product "Sdk" and version "1.3.1_17"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_18 Search vendor "Sun" for product "Sdk" and version "1.3.1_18"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.3.1_19 Search vendor "Sun" for product "Sdk" and version "1.3.1_19"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2 Search vendor "Sun" for product "Sdk" and version "1.4.2"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_1 Search vendor "Sun" for product "Sdk" and version "1.4.2_1"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_2 Search vendor "Sun" for product "Sdk" and version "1.4.2_2"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_3 Search vendor "Sun" for product "Sdk" and version "1.4.2_3"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_4 Search vendor "Sun" for product "Sdk" and version "1.4.2_4"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_5 Search vendor "Sun" for product "Sdk" and version "1.4.2_5"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_6 Search vendor "Sun" for product "Sdk" and version "1.4.2_6"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_7 Search vendor "Sun" for product "Sdk" and version "1.4.2_7"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_8 Search vendor "Sun" for product "Sdk" and version "1.4.2_8"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_9 Search vendor "Sun" for product "Sdk" and version "1.4.2_9"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_10 Search vendor "Sun" for product "Sdk" and version "1.4.2_10"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_11 Search vendor "Sun" for product "Sdk" and version "1.4.2_11"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_12 Search vendor "Sun" for product "Sdk" and version "1.4.2_12"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_13 Search vendor "Sun" for product "Sdk" and version "1.4.2_13"		-		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				1.4.2_14 Search vendor "Sun" for product "Sdk" and version "1.4.2_14"		-		Affected