Description
Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.3.1_18 and earlier allows applets to gain privileges via a GIF image with a block with a 0 width field, which triggers memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.8-1jpp.1.el5 | RHSA-2007:0166 |
| RHEL 5 | java-1.5.0-bea +5 | 1.5.0.11-1jpp.1.el5 | RHSA-2007:0956 |
| RHEL 5 | java-1.5.0-ibm +6 | 1:1.5.0.4-1jpp.3.el5 | RHSA-2007:0167 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.8-1jpp.1.el4 | RHSA-2007:0166 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.4-1jpp.3.el4 | RHSA-2007:0167 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.8-1jpp.1.el3 | RHSA-2007:0166 |
| RHEL 2 | IBMJava2-JRE | 1:1.3.1-12 | RHSA-2007:0072 |
| RHEL 2 | IBMJava2-SDK | 1:1.3.1-11 | RHSA-2007:0072 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sun Microsystems Java - '.GIF' File Parsing Memory Corruption EDB-3168 · remote · Jan 21, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0956 Red Hat Security Advisory: java-1.5.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0166 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0167 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0072 Red Hat Security Advisory: IBMJava2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 20070117 ZDI-07-005: Sun Microsystems Java GIF File Parsing Memory Corruption Vulnerability mailing-list
- 102760 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307177
- 24468 third-party-advisory
- RHSA-2007:0166 vendor-advisory
- VU#388289 third-party-advisory
- HPSBUX02196 vendor-advisory
- 26049 third-party-advisory
- ADV-2007-1814 vdb-entry
- 24202 third-party-advisory
- 20070121 Sun Microsystems Java GIF File Parsing Memory Corruption Vulnerability Prove Of Concept Exploit mailing-list
- 25283 third-party-advisory
- 32834 vdb-entry
- 24189 third-party-advisory
- SUSE-SA:2007:045 vendor-advisory
- APPLE-SA-2007-12-14 vendor-advisory
- 2158 third-party-advisory
- 1017520 vdb-entry
- RHSA-2007:0956 vendor-advisory
- http://support.novell.com/techcenter/psdb/4f850d1e2b871db609de64ec70f0089c.html
- oval:org.mitre.oval:def:11073 vdb-entry signature
- 26645 third-party-advisory
- RHSA-2007:0167 vendor-advisory
- 26119 third-party-advisory
- 23757 third-party-advisory
- 22085 vdb-entry
- ADV-2007-4224 vdb-entry
- 24993 third-party-advisory
- 28115 third-party-advisory
- RHSA-2008:0261 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-005.html
- ADV-2007-0211 vdb-entry
- 27203 third-party-advisory
- jre-gif-bo(31537) vdb-entry
- ADV-2007-0936 vdb-entry
- GLSA-200702-08 vendor-advisory
- http://support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.html
- GLSA-200702-07 vendor-advisory
- TA07-022A third-party-advisory
- BEA07-172.00 vendor-advisory