CVE-2007-2788 Integer overflow in n/a

Medium 6.8 Published 22 May 2007 Updated 7 Aug 2024

Remote attackers can execute arbitrary code or crash the JVM via crafted JPEG or BMP files exploiting an integer overflow in the ICC profile parser.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2007-2788?

CVE-2007-2788 is a medium-severity vulnerability in Sun Jdk, published on 22 May 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.

Weakness: CWE-189

Which versions are affected by CVE-2007-2788?

It affects 3 products.

Products include Sun Jdk, Sun Jre, Sun Sdk.

How do I fix CVE-2007-2788?

Upgrade to a fixed version.

Is CVE-2007-2788 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-2788 exists.

Public exploit code: 1 Exploit-DB entry.

All Sun Jdk vulnerabilities

Sources

Also known as CVE-2007-3004, GHSA-cjwj-wvcj-rr5c.