CVE-2007-4988: canonical ubuntu_linux

CVSS: 7.8v3.1HighModified

AliasesDEBIAN-CVE-2007-4988

Published 24-09-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-4988 is a high (CVSS 7.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 3.09% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

42/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

3.09%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 1

DSA-1858-1 DSA-1903-1 DTSA-63-1 OPENSUSE-SU-2024:10596-1 RHSA-2008:0145

Timeline

24-09-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.8v2.06.8

EPSS trend

Probability

3.09%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.09% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.09%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Affected systems

Debian2 products

graphicsmagick< 1.1.11-1
imagemagick< 7:6.2.4.5.dfsg1-2

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04

Imagemagick1 product

imagemagick< 6.3.5-9

3 vendors · 4 products

References

26 links

secunia.com/advisories/27364Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/support/errata/RHSA-2008-0145.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.securityfocus.com/archive/1/483572/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.ubuntu.com/usn/usn-523-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/27309Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/29786Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/bid/25765VDB EntryX Refsource BIDBroken LinkExploitPatchThird Party Advisory
www.imagemagick.org/script/changelog.phpX Refsource CONFIRMRelease Notes
www.vupen.com/english/advisories/2007/3245VDB EntryX Refsource VUPENBroken Link
labs.idefense.com/intelligence/vulnerabilities/display.php?id=597Third Party AdvisoryX Refsource IDEFENSEBroken Link

Show all 26 references

security.gentoo.org/glsa/glsa-200710-27.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securitytracker.com/id?1018729VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/27048Third Party AdvisoryX Refsource SECUNIABroken Link
exchange.xforce.ibmcloud.com/vulnerabilities/36737VDB EntryX Refsource XFThird Party Advisory
secunia.com/advisories/28721Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/27439Third Party AdvisoryX Refsource SECUNIABroken Link
issues.rpath.com/browse/RPL-1743X Refsource CONFIRMBroken Link
www.debian.org/security/2009/dsa-1858Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.htmlMailing ListX Refsource MLISTBroken Link
secunia.com/advisories/26926Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/en/security/advisories?name=MDVSA-2008:035Vendor AdvisoryX Refsource MANDRIVABroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9656VDB EntrySignatureX Refsource OVALBroken Link
bugs.gentoo.org/show_bug.cgi?id=186030X Refsource CONFIRMIssue Tracking
www.novell.com/linux/security/advisories/2007_23_sr.htmlVendor AdvisoryX Refsource SUSEBroken Link
secunia.com/advisories/36260Third Party AdvisoryX Refsource SECUNIABroken Link
security-tracker.debian.org/tracker/CVE-2007-4988Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities