CVE-2007-2237

moderate-risk
Published 2007-06-06

Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, which triggers a divide-by-zero error.

Do I need to act?

!
60.5% chance of exploitation in next 30 days
EPSS score — higher than 39% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
2 public exploits available
4044, 30160
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Microsoft

References (18)

Broken Link http://osvdb.org/38494
Broken Link http://www.csis.dk/dk/forside/GdiPlus.pdf
Third Party Advisory http://www.kb.cert.org/vuls/id/290961
Broken Link http://www.securityfocus.com/archive/1/470746/100/0/threaded
Broken Link http://www.securityfocus.com/bid/24346
Broken Link http://www.securitytracker.com/id?1018202
Broken Link http://www.vupen.com/english/advisories/2007/2083
VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/34743
Third Party Advisory https://www.exploit-db.com/exploits/4044
Broken Link http://osvdb.org/38494
Broken Link http://www.csis.dk/dk/forside/GdiPlus.pdf
Third Party Advisory http://www.kb.cert.org/vuls/id/290961
Broken Link http://www.securityfocus.com/archive/1/470746/100/0/threaded
Broken Link http://www.securityfocus.com/bid/24346
Broken Link http://www.securitytracker.com/id?1018202
Broken Link http://www.vupen.com/english/advisories/2007/2083
VDB Entry https://exchange.xforce.ibmcloud.com/vulnerabilities/34743
Third Party Advisory https://www.exploit-db.com/exploits/4044
49
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 26/34 · High
Exposure 5/34 · Minimal