CVE-2007-2788: Sun JDK

Medium severity, CVSS 6.8. EPSS: 18.2% chance of exploitation in the next 30 days.

Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_20 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file that triggers a buffer overflow.

Affected products

• Sun JDK: version 1.5.0 only; version 1.6.0 only
• Sun JRE: version 1.3.1 only; version 1.3.1_2 only; version 1.3.1_03 only; version 1.3.1_04 only; version 1.3.1_05 only; version 1.3.1_06 only; …
• Sun SDK: version 1.3.1 only; version 1.3.1_01 only; version 1.3.1_01a only; version 1.3.1_02 only; version 1.3.1_03 only; version 1.3.1_04 only; …

Published 2007-05-22. Last modified 2026-06-16.