CVE-2007-5378: tcl_tk tk_toolkit
Vulnerability summary
CVE-2007-5378 is a medium (CVSS 4.3) vulnerability in tcl_tk tk_toolkit. EPSS estimates a 2.64% chance of exploitation in the next 30 days, higher than 85.6% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 12-10-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.64%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.64% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Debian3 products
- libtk-img< 1.3-release-8
- tk8.3< 8.3.5-6etch1
- tk8.4< 8.4.12-1etch1 | < 8.4.9-1sarge1
Tcl_tk1 product
- tk_toolkit≤ 8.3.5 | ≤ 8.4.12
2 vendors · 4 products
References
26 links- www.vmware.com/security/advisories/VMSA-2008-0009.htmlX Refsource CONFIRM
Show all 26 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9480VDB EntrySignatureX Refsource OVAL
- sourceforge.net/tracker/?func=detail&atid=112997&aid=1458234&group_id=12997X Refsource CONFIRM
