Vulnerability Description
Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in X.Org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or obtain sensitive information via crafted images with large or negative values that trigger a buffer overflow.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| X.Org | Libx11 | <= 1.0.2 |
| Debian | Debian Linux | 3.1 |
| Canonical | Ubuntu Linux | 6.06 |
Related Weaknesses (CWE)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414045Third Party Advisory
- http://issues.foresightlinux.org/browse/FL-223Broken Link
- http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.htmlMailing ListThird Party Advisory
- http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.htmlMailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2007-0125.htmlThird Party Advisory
- http://secunia.com/advisories/24739Broken Link
- http://secunia.com/advisories/24741Broken Link
- http://secunia.com/advisories/24745Broken Link
- http://secunia.com/advisories/24756Broken Link
- http://secunia.com/advisories/24758Broken Link
- http://secunia.com/advisories/24765Broken Link
- http://secunia.com/advisories/24771Broken Link
- http://secunia.com/advisories/24791Broken Link
- http://secunia.com/advisories/24953Broken Link
- http://secunia.com/advisories/24975Broken Link
FAQ
What is CVE-2007-1667?
CVE-2007-1667 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in X.Org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a...
How severe is CVE-2007-1667?
CVE-2007-1667 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-1667?
Check the references section above for vendor advisories and patch information. Affected products include: X.Org Libx11, Debian Debian Linux, Canonical Ubuntu Linux.