CVE-2007-0243

Published: Jan 17, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.

Affected (37)

Products: Sun: Jdk, Jre, Sdk

3 products

Configuration A

37 vulnerable

Vulnerable Software	Affected Versions
Sun Jdk	Up to 1.5.0
Sun Jdk	Version 1.5.0 update3
Sun Jdk	Version 1.5.0 update4
Sun Jdk	Version 1.5.0 update5
Sun Jdk	Version 1.5.0 update7
Sun Jdk	Version 1.5.0 update8
Sun Jre	Up to 1.3.1
Sun Jre	Version 1.3.1 update16
Sun Jre	Version 1.4.2_10
Sun Jre	Version 1.4.2_11
Sun Jre	Version 1.4.2_12
Sun Jre	Version 1.4.2_1
Sun Jre	Version 1.4.2_2
Sun Jre	Version 1.4.2_3
Sun Jre	Version 1.4.2_4
Sun Jre	Version 1.4.2_5
Sun Jre	Version 1.4.2_6
Sun Jre	Version 1.4.2_7
Sun Jre	Version 1.4.2_8
Sun Jre	Version 1.4.2_9
Sun Jre	Version 1.5.0 update3
Sun Jre	Version 1.5.0 update4
Sun Jre	Version 1.5.0 update5
Sun Jre	Version 1.5.0 update6
Sun Jre	Version 1.5.0 update7
Sun Jre	Version 1.5.0 update8
Sun Jre	Version 1.5.0 update9
Sun Sdk	Version 1.3.1_01
Sun Sdk	Version 1.3.1_01a
Sun Sdk	Version 1.3.1_16
Sun Sdk	Version 1.3.1_18
Sun Sdk	Version 1.4.2
Sun Sdk	Version 1.4.2_03
Sun Sdk	Version 1.4.2_08
Sun Sdk	Version 1.4.2_09
Sun Sdk	Version 1.4.2_10
Sun Sdk	Version 1.4.2_12

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (80)

http://dev2dev.bea.com/pub/advisory/242

Source: cve@mitre.org

http://docs.info.apple.com/article.html?artnum=307177

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00876579

Source: cve@mitre.org

http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html

Source: cve@mitre.org

http://osvdb.org/32834

Source: cve@mitre.org

http://secunia.com/advisories/23757

Source: cve@mitre.org

http://secunia.com/advisories/24189

Source: cve@mitre.org

http://secunia.com/advisories/24202

Source: cve@mitre.org

http://secunia.com/advisories/24468

Source: cve@mitre.org

http://secunia.com/advisories/24993

Source: cve@mitre.org

http://secunia.com/advisories/25283

Source: cve@mitre.org

http://secunia.com/advisories/26049

Source: cve@mitre.org

http://secunia.com/advisories/26119

Source: cve@mitre.org

http://secunia.com/advisories/26645

Source: cve@mitre.org

http://secunia.com/advisories/27203

Source: cve@mitre.org

http://secunia.com/advisories/28115

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200702-08.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/2158

Source: cve@mitre.org

http://securitytracker.com/id?1017520

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1

Source: cve@mitre.org

Patch

http://support.novell.com/techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.html

Source: cve@mitre.org

http://support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.html

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200702-07.xml

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/388289

Source: cve@mitre.org

US Government Resource

http://www.novell.com/linux/security/advisories/2007_45_java.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0166.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0167.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0956.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0261.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/457159/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/457638/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/22085

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA07-022A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2007/0211

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/0936

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1814

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4224

Source: cve@mitre.org

http://www.zerodayinitiative.com/advisories/ZDI-07-005.html

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/31537

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11073

Source: cve@mitre.org

http://dev2dev.bea.com/pub/advisory/242