CVE-2007-0455: canonical ubuntu_linux

Modified

AliasesDEBIAN-CVE-2007-0455

Published 30-01-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-0455 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 12.26% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

12.26%

0%100%

Medium · +0.30 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5

DSA-1936-1 RHSA-2007:0153 RHSA-2007:0155 RHSA-2007:0162 RHSA-2008:0146

Timeline

30-01-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

12.26%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Increase +0.30 pp

From 11.95% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat3 products

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04

Debian1 product

libgd2< 2.0.35.dfsg-1

Fedoraproject1 product

fedoraEOL13 | 14

Gd_graphics_library_project1 product

gd_graphics_library≤ 2.0.33

Php1 product

php≥ 4.4.0, < 4.4.7

6 vendors · 8 products

References

36 links

secunia.com/advisories/24022Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/29157Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/24107Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/24143Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securityfocus.com/bid/22289VDB EntryX Refsource BIDThird Party Advisory
www.securityfocus.com/archive/1/466166/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2007/0400VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/23916Third Party AdvisoryX Refsource SECUNIANot ApplicableVendor Advisory
secunia.com/advisories/24151Third Party AdvisoryX Refsource SECUNIANot Applicable
www.redhat.com/support/errata/RHSA-2007-0162.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory

Show all 36 references

secunia.com/advisories/42813Third Party AdvisoryX Refsource SECUNIANot Applicable
www.mandriva.com/security/advisories?name=MDKSA-2007:038Vendor AdvisoryX Refsource MANDRIVABroken Link
www.mandriva.com/security/advisories?name=MDKSA-2007:035Vendor AdvisoryX Refsource MANDRIVABroken Link
www.vupen.com/english/advisories/2011/0022VDB EntryX Refsource VUPENPermissions Required
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11303VDB EntrySignatureX Refsource OVALThird Party Advisory
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607X Refsource CONFIRMIssue TrackingThird Party Advisory
lists.rpath.com/pipermail/security-announce/2007-February/000145.htmlMailing ListX Refsource MLISTBroken Link
lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
secunia.com/advisories/24945Third Party AdvisoryX Refsource SECUNIANot Applicable
issues.rpath.com/browse/RPL-1268X Refsource CONFIRMBroken Link
www.mandriva.com/security/advisories?name=MDKSA-2007:109Vendor AdvisoryX Refsource MANDRIVABroken Link
www.redhat.com/support/errata/RHSA-2008-0146.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.trustix.org/errata/2007/0007Vendor AdvisoryX Refsource TRUSTIXBroken Link
secunia.com/advisories/24053Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/24924Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/24052Third Party AdvisoryX Refsource SECUNIANot Applicable
lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2007-0155.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/24965Third Party AdvisoryX Refsource SECUNIANot Applicable
www.mandriva.com/security/advisories?name=MDKSA-2007:036Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/25575Third Party AdvisoryX Refsource SECUNIANot Applicable
fedoranews.org/cms/node/2631Vendor AdvisoryX Refsource FEDORABroken Link
issues.rpath.com/browse/RPL-1030X Refsource CONFIRMBroken Link
www.ubuntu.com/usn/usn-473-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.redhat.com/support/errata/RHSA-2007-0153.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security-tracker.debian.org/tracker/CVE-2007-0455Advisory