CVE-2007-0243: sun jdk

Modified

AliasesRHSA-2007:0166RHSA-2007:0167

Published 17-01-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-0243 is a medium (CVSS 6.8) vulnerability in sun jdk. EPSS estimates a 11.62% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 21-01-2007)

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

11.62%

0%100%

Medium · +0.29 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 4 · Duplicates 1

RHSA-2007:0072 RHSA-2007:0956 RHSA-2008:0261 RHSA-2008:0524 CVE-2007-0234

Timeline

17-01-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

11.62%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Increase +0.29 pp

From 11.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databaseremotewindowsVerified
Sun Microsystems Java - '.GIF' File Parsing Memory Corruption
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat14 products

java-1.4.2-ibm< 0:1.4.2.8-1jpp.1.el3 | < 0:1.4.2.8-1jpp.1.el4 | < 0:1.4.2.8-1jpp.1.el5
java-1.4.2-ibm-demo< 0:1.4.2.8-1jpp.1.el3 | < 0:1.4.2.8-1jpp.1.el4 | < 0:1.4.2.8-1jpp.1.el5
java-1.4.2-ibm-devel< 0:1.4.2.8-1jpp.1.el3 | < 0:1.4.2.8-1jpp.1.el4 | < 0:1.4.2.8-1jpp.1.el5
java-1.4.2-ibm-javacomm< 0:1.4.2.8-1jpp.1.el4 | < 0:1.4.2.8-1jpp.1.el5
java-1.4.2-ibm-jdbc< 0:1.4.2.8-1jpp.1.el3 | < 0:1.4.2.8-1jpp.1.el4 | < 0:1.4.2.8-1jpp.1.el5

Show all 14

Sun3 products

jdk≤ 1.5.0 | 1.5.0:update3 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update7 | 1.5.0:update8
jre≤ 1.3.1 | 1.3.1:update16 | 1.4.2_1 | 1.4.2_2 | 1.4.2_3 | 1.4.2_4 | 1.4.2_5 | 1.4.2_6 | 1.4.2_7 | 1.4.2_8 | 1.4.2_9 | 1.4.2_10 | 1.4.2_11 | 1.4.2_12 | 1.5.0:update3 | 1.5.0:update4 | 1.5.0:update5 | 1.5.0:update6 | 1.5.0:update7 | 1.5.0:update8 | 1.5.0:update9
sdk1.3.1_01 | 1.3.1_01a | 1.3.1_16 | 1.3.1_18 | 1.4.2 | 1.4.2_03 | 1.4.2_08 | 1.4.2_09 | 1.4.2_10 | 1.4.2_12

2 vendors · 17 products

References

58 links

www.securityfocus.com/archive/1/457159/100/0/threadedMailing ListX Refsource BUGTRAQ
sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1Vendor AdvisoryX Refsource SUNALERTPatch
docs.info.apple.com/article.html?artnum=307177X Refsource MISC
secunia.com/advisories/24468Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-0166.htmlVendor AdvisoryX Refsource REDHAT
www.kb.cert.org/vuls/id/388289Third Party AdvisoryX Refsource CERT VNUS Government Resource
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00876579Vendor AdvisoryX Refsource HP
secunia.com/advisories/26049Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/1814VDB EntryX Refsource VUPEN
secunia.com/advisories/24202Third Party AdvisoryX Refsource SECUNIA

Show all 58 references

www.securityfocus.com/archive/1/457638/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/25283Third Party AdvisoryX Refsource SECUNIA
osvdb.org/32834VDB EntryX Refsource OSVDB
secunia.com/advisories/24189Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2007_45_java.htmlVendor AdvisoryX Refsource SUSE
lists.apple.com/archives/Security-announce/2007/Dec/msg00001.htmlVendor AdvisoryX Refsource APPLE
securityreason.com/securityalert/2158Third Party AdvisoryX Refsource SREASON
securitytracker.com/id?1017520VDB EntryX Refsource SECTRACK
www.redhat.com/support/errata/RHSA-2007-0956.htmlVendor AdvisoryX Refsource REDHAT
support.novell.com/techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.htmlX Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11073VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/26645Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-0167.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/26119Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/23757Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/22085VDB EntryX Refsource BID
www.vupen.com/english/advisories/2007/4224VDB EntryX Refsource VUPEN
secunia.com/advisories/24993Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28115Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0261.htmlVendor AdvisoryX Refsource REDHAT
www.zerodayinitiative.com/advisories/ZDI-07-005.htmlX Refsource MISCPatchVendor Advisory
www.vupen.com/english/advisories/2007/0211VDB EntryX Refsource VUPEN
secunia.com/advisories/27203Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/31537VDB EntryX Refsource XF
www.vupen.com/english/advisories/2007/0936VDB EntryX Refsource VUPEN
security.gentoo.org/glsa/glsa-200702-08.xmlVendor AdvisoryX Refsource GENTOO
support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.htmlX Refsource CONFIRM
www.gentoo.org/security/en/glsa/glsa-200702-07.xmlVendor AdvisoryX Refsource GENTOO
www.us-cert.gov/cas/techalerts/TA07-022A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
dev2dev.bea.com/pub/advisory/242Vendor AdvisoryX Refsource BEA
access.redhat.com/errata/RHSA-2007:0166Advisory
www-128.ibm.com/developerworks/java/jdk/alerts/ARTICLE
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=236892REPORT
bugzilla.redhat.com/show_bug.cgi?id=237283REPORT
bugzilla.redhat.com/show_bug.cgi?id=237284REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0166.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-0243REPORT
bugzilla.redhat.com/show_bug.cgi?id=325941REPORT
www.cve.org/CVERecord?id=CVE-2007-0243Advisory
nvd.nist.gov/vuln/detail/CVE-2007-0243Advisory
access.redhat.com/errata/RHSA-2007:0167Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=236894REPORT
bugzilla.redhat.com/show_bug.cgi?id=237281REPORT
bugzilla.redhat.com/show_bug.cgi?id=237290REPORT
bugzilla.redhat.com/show_bug.cgi?id=237685REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0167.jsonAdvisory