NVD

CVE-2007-0455 Detail

Description

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: 7.5 HIGH

Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Vendor Statements (disclaimer)

Official Statement from Red Hat (05/14/2007)

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=234312 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607	Issue Tracking Third Party Advisory
http://fedoranews.org/cms/node/2631	Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html	Mailing List Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.html	Mailing List Third Party Advisory
http://lists.rpath.com/pipermail/security-announce/2007-February/000145.html	Broken Link
http://rhn.redhat.com/errata/RHSA-2007-0155.html	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:035	Broken Link
http://www.mandriva.com/security/advisories?name=MDKSA-2007:036	Broken Link
http://www.mandriva.com/security/advisories?name=MDKSA-2007:038	Broken Link
http://www.mandriva.com/security/advisories?name=MDKSA-2007:109	Broken Link
http://www.redhat.com/support/errata/RHSA-2007-0153.html	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2007-0162.html	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0146.html	Third Party Advisory
http://www.securityfocus.com/archive/1/466166/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/22289	Third Party Advisory VDB Entry
http://www.trustix.org/errata/2007/0007	Broken Link
http://www.ubuntu.com/usn/usn-473-1	Third Party Advisory
http://www.vupen.com/english/advisories/2007/0400	Permissions Required
http://www.vupen.com/english/advisories/2011/0022	Permissions Required
https://issues.rpath.com/browse/RPL-1030	Broken Link
https://issues.rpath.com/browse/RPL-1268	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11303	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

5 change records found show changes

Modified Analysis by NIST 7/21/2022 11:17:50 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR cpe:2.3:a:php:php::::::::* versions from (including) 4.4.0 up to (excluding) 4.4.7
Added	CPE Configuration		OR cpe:2.3:o:canonical:ubuntu_linux:6.06::::::: cpe:2.3:o:canonical:ubuntu_linux:6.10::::::: cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::
Added	CPE Configuration		OR cpe:2.3:o:fedoraproject:fedora:13::::::: cpe:2.3:o:fedoraproject:fedora:14:::::::
Added	CPE Configuration		OR cpe:2.3:o:redhat:enterprise_linux_desktop:3.0::::::: cpe:2.3:o:redhat:enterprise_linux_desktop:4.0::::::: cpe:2.3:o:redhat:enterprise_linux_server:3.0::::::: cpe:2.3:o:redhat:enterprise_linux_server:4.0::::::: cpe:2.3:o:redhat:enterprise_linux_workstation:3.0::::::: cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:::::::
Changed	CPE Configuration	Record truncated, showing 500 of 631 characters. View Entire Change Record OR cpe:2.3:a:gd_graphics_library:gdlib:2.0.1::::::: cpe:2.3:a:gd_graphics_library:gdlib:2.0.15::::::: cpe:2.3:a:gd_graphics_library:gdlib:2.0.20::::::: cpe:2.3:a:gd_graphics_library:gdlib:2.0.21::::::: cpe:2.3:a:gd_graphics_library:gdlib:2.0.22::::::: cpe:2.3:a:gd_graphics_library:gdlib:2.0.23::::::: cpe:2.3:a:gd_graphics_library:gdlib:2.0.26::::::: cpe:2.3:a:gd_graphics_library:gdlib:2.0.27::::*:	OR cpe:2.3:a:gd_graphics_library_project:gd_graphics_library::::::::* versions up to (including) 2.0.33
Added	CWE		NIST CWE-120
Removed	CWE	NIST CWE-119
Changed	Reference Type	http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607 Vendor Advisory	http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607 Issue Tracking, Third Party Advisory
Changed	Reference Type	http://fedoranews.org/cms/node/2631 No Types Assigned	http://fedoranews.org/cms/node/2631 Broken Link
Changed	Reference Type	http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html No Types Assigned	http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html Mailing List, Third Party Advisory
Changed	Reference Type	http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.html No Types Assigned	http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.html Mailing List, Third Party Advisory
Changed	Reference Type	http://lists.rpath.com/pipermail/security-announce/2007-February/000145.html No Types Assigned	http://lists.rpath.com/pipermail/security-announce/2007-February/000145.html Broken Link
Changed	Reference Type	http://rhn.redhat.com/errata/RHSA-2007-0155.html No Types Assigned	http://rhn.redhat.com/errata/RHSA-2007-0155.html Third Party Advisory
Changed	Reference Type	http://secunia.com/advisories/23916 Vendor Advisory	http://secunia.com/advisories/23916 Not Applicable, Vendor Advisory
Changed	Reference Type	http://secunia.com/advisories/24022 No Types Assigned	http://secunia.com/advisories/24022 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24052 No Types Assigned	http://secunia.com/advisories/24052 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24053 No Types Assigned	http://secunia.com/advisories/24053 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24107 No Types Assigned	http://secunia.com/advisories/24107 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24143 No Types Assigned	http://secunia.com/advisories/24143 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24151 No Types Assigned	http://secunia.com/advisories/24151 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24924 No Types Assigned	http://secunia.com/advisories/24924 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24945 No Types Assigned	http://secunia.com/advisories/24945 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/24965 No Types Assigned	http://secunia.com/advisories/24965 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/25575 No Types Assigned	http://secunia.com/advisories/25575 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/29157 No Types Assigned	http://secunia.com/advisories/29157 Not Applicable
Changed	Reference Type	http://secunia.com/advisories/42813 No Types Assigned	http://secunia.com/advisories/42813 Not Applicable
Changed	Reference Type	http://www.mandriva.com/security/advisories?name=MDKSA-2007:035 No Types Assigned	http://www.mandriva.com/security/advisories?name=MDKSA-2007:035 Broken Link
Changed	Reference Type	http://www.mandriva.com/security/advisories?name=MDKSA-2007:036 No Types Assigned	http://www.mandriva.com/security/advisories?name=MDKSA-2007:036 Broken Link
Changed	Reference Type	http://www.mandriva.com/security/advisories?name=MDKSA-2007:038 No Types Assigned	http://www.mandriva.com/security/advisories?name=MDKSA-2007:038 Broken Link
Changed	Reference Type	http://www.mandriva.com/security/advisories?name=MDKSA-2007:109 No Types Assigned	http://www.mandriva.com/security/advisories?name=MDKSA-2007:109 Broken Link
Changed	Reference Type	http://www.redhat.com/support/errata/RHSA-2007-0153.html No Types Assigned	http://www.redhat.com/support/errata/RHSA-2007-0153.html Third Party Advisory
Changed	Reference Type	http://www.redhat.com/support/errata/RHSA-2007-0162.html No Types Assigned	http://www.redhat.com/support/errata/RHSA-2007-0162.html Third Party Advisory
Changed	Reference Type	http://www.redhat.com/support/errata/RHSA-2008-0146.html No Types Assigned	http://www.redhat.com/support/errata/RHSA-2008-0146.html Third Party Advisory
Changed	Reference Type	http://www.securityfocus.com/archive/1/466166/100/0/threaded No Types Assigned	http://www.securityfocus.com/archive/1/466166/100/0/threaded Third Party Advisory, VDB Entry
Changed	Reference Type	http://www.securityfocus.com/bid/22289 No Types Assigned	http://www.securityfocus.com/bid/22289 Third Party Advisory, VDB Entry
Changed	Reference Type	http://www.trustix.org/errata/2007/0007 No Types Assigned	http://www.trustix.org/errata/2007/0007 Broken Link
Changed	Reference Type	http://www.ubuntu.com/usn/usn-473-1 No Types Assigned	http://www.ubuntu.com/usn/usn-473-1 Third Party Advisory
Changed	Reference Type	http://www.vupen.com/english/advisories/2007/0400 No Types Assigned	http://www.vupen.com/english/advisories/2007/0400 Permissions Required
Changed	Reference Type	http://www.vupen.com/english/advisories/2011/0022 No Types Assigned	http://www.vupen.com/english/advisories/2011/0022 Permissions Required
Changed	Reference Type	https://issues.rpath.com/browse/RPL-1030 No Types Assigned	https://issues.rpath.com/browse/RPL-1030 Broken Link
Changed	Reference Type	https://issues.rpath.com/browse/RPL-1268 No Types Assigned	https://issues.rpath.com/browse/RPL-1268 Broken Link
Changed	Reference Type	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11303 No Types Assigned	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11303 Third Party Advisory

Quick Info

CVE Dictionary Entry:
CVE-2007-0455
NVD Published Date:
01/30/2007
NVD Last Modified:
07/21/2022
Source:
Red Hat, Inc.

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2007-0455 Detail

Description

Metrics

Vendor Statements (disclaimer)

Official Statement from Red Hat (05/14/2007)

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by Red Hat, Inc. 5/13/2024 9:42:45 PM

Modified Analysis by NIST 7/21/2022 11:17:50 AM

CVE Modified by Red Hat, Inc. 10/16/2018 12:32:52 PM

CVE Modified by Red Hat, Inc. 10/10/2017 9:31:36 PM

Initial CVE Analysis 1/30/2007 2:17:00 PM

Quick Info