CVE-2007-2789 — JDK vulnerability

CWE-3997 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
5.1%
top 10.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
SUN JDKSUN JRESUN SDK
Timeline
PublishedMay 22
Latest updateMay 1

Description

The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when running on Unix/Linux systems, allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file, such as /dev/tty.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDsun/jdk1.5.0, 1.6.0+1
▶NVDsun/jre36 versions+35
▶NVDsun/sdk36 versions+35

Patches

Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-r5wh-4xhf-r4xr: The BMP image parser in Sun Java Development Kit (JDK) before 1↗2022-05-01
▶
CVEList
CVE-2007-2789: The BMP image parser in Sun Java Development Kit (JDK) before 1↗2007-05-22
▶

💥Exploits & PoCs

1
Exploit-DB
Sun Java JDK 1.x - Multiple Vulnerabilities↗2007-05-16
▶

📋Vendor Advisories

3
Red Hat
OpenJDK BMP parsing DoS with UNC ICC links (6632445)↗2009-11-03
▶
Red Hat
BMP image parser vulnerability↗2007-05-21
▶
Red Hat
SUN JRE: Unspecified vulnerability in Sun JRE↗2007-04-15
▶
CVE-2007-2789 — SUN JDK vulnerability | cvebase