{"vuid":"VU#388289","idnumber":"388289","name":"Sun Microsystems Java GIF image processing buffer overflow","keywords":["Sun Microsystems Java","buffer overflow","GIF image processing","width of 0","specially crafted"],"overview":"A vulnerability in the Sun Java Runtime Environment may allow an attacker to execute arbitrary code on a vulnerable system.","clean_desc":"The Sun Java Runtime Environment (JRE) allows users to run Java applications in a browser or as standalone programs. Sun has made the JRE available for multiple operating systems. When a GIF image with a specified width of 0 is processed, the Sun JRE will overwrite memory contents, which can cause pointer corruption. Note that exploit code for this vulnerability is publicly available.","impact":"A remote unauthenticated attacker may be able to execute arbitrary code.","resolution":"Apply an update\nPer Sunsolve document 102760, this issue is addressed in\nJDK and JRE 5.0 Update 10 or later\nSDK and JRE 1.4.2_13 or later\nSDK and JRE 1.3.1_19 or later","workarounds":"Disable Java Disable Java in your web browser, as specified in the Securing Your Web Browser document.","sysaffected":"","thanks":"Thanks to ZDI for reporting this vulnerability, who in turn credit an anonymous researcher.","author":"This document was written by Will Dormann.","public":["http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1","http://www.zerodayinitiative.com/advisories/ZDI-07-005.html","http://secunia.com/advisories/23757/","http://www.securityfocus.com/bid/22085","http://securitytracker.com/alerts/2007/Jan/1017520.html","http://secunia.com/advisories/24189/","http://secunia.com/advisories/24202/","http://secunia.com/advisories/24468/","http://secunia.com/advisories/25283/"],"cveids":["CVE-2007-0243"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2007-01-17T17:20:40Z","publicdate":"2007-01-16T00:00:00Z","datefirstpublished":"2007-01-17T18:41:55Z","dateupdated":"2007-05-16T18:57:42Z","revision":24,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"20","cam_exploitation":"7","cam_internetinfrastructure":"10","cam_population":"14","cam_impact":"18","cam_easeofexploitation":"10","cam_attackeraccessrequired":"18","cam_scorecurrent":"31.4685","cam_scorecurrentwidelyknown":"31.4685","cam_scorecurrentwidelyknownexploited":"42.525","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":31.4685,"vulnote":null}