HIGH
XGetPixel() integer overflow
Published Mar 24, 2007
9.3
HIGHCVSS 2.0
EPSS 4.61%
Description
Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in X.Org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or obtain sensitive information via crafted images with large or negative values that trigger a buffer overflow.
Affected products
No data.
Configuration 2
OR
- 3.1
- 4.0
Configuration 3
OR
- 6.06
- 6.10
- 7.04
No data.
Red Hat Enterprise Linux 2.1
XFree86-0:4.1.0-82.EL
Fixed · RHSA-2007:0125
Red Hat Enterprise Linux 3
XFree86-0:4.3.0-120.EL
Fixed · RHSA-2007:0125
Red Hat Enterprise Linux 4
xorg-x11-0:6.8.2-1.EL.13.37.7
Fixed · RHSA-2007:0126
Red Hat Enterprise Linux 5
libX11-0:1.0.3-8.0.1.el5
Fixed · RHSA-2007:0157
Red Hat Enterprise Linux 5
xorg-x11-apps-0:7.1-4.0.1.el5
Fixed · RHSA-2007:0157
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 2.1 | XFree86-0:4.1.0-82.EL | Fixed | RHSA-2007:0125 |
| Red Hat Enterprise Linux 3 | XFree86-0:4.3.0-120.EL | Fixed | RHSA-2007:0125 |
| Red Hat Enterprise Linux 4 | xorg-x11-0:6.8.2-1.EL.13.37.7 | Fixed | RHSA-2007:0126 |
| Red Hat Enterprise Linux 5 | libX11-0:1.0.3-8.0.1.el5 | Fixed | RHSA-2007:0157 |
| Red Hat Enterprise Linux 5 | xorg-x11-apps-0:7.1-4.0.1.el5 | Fixed | RHSA-2007:0157 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
9.3 HIGH NVD
AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.61% 0.04613
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.04613
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (20 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 4.61% (0.04613) | 91.39th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.61% (0.04613) | 90.46th | v5 (v2026.06.15) |
| Apr 17, 2026 | 2.15% (0.02145) | 84.25th | v4 (v2025.03.14) |
| Mar 30, 2025 | 1.14% (0.01140) | 76.48th | v4 (v2025.03.14) |
| Mar 29, 2025 | 2.74% (0.02745) | 76.63th | v4 (v2025.03.14) |
| Mar 17, 2025 | 1.14% (0.01140) | 76.95th | v4 (v2025.03.14) |
| Dec 17, 2024 | 12.84% (0.12838) | 95.47th | v3 (v2023.03.01) |
| Oct 3, 2024 | 8.35% (0.08353) | 94.53th | v3 (v2023.03.01) |
| Jun 27, 2024 | 6.91% (0.06906) | 93.96th | v3 (v2023.03.01) |
| May 19, 2024 | 2.43% (0.02431) | 89.96th | v3 (v2023.03.01) |
| Apr 11, 2024 | 2.94% (0.02939) | 90.67th | v3 (v2023.03.01) |
| Mar 4, 2024 | 3.20% (0.03196) | 90.90th | v3 (v2023.03.01) |
| Jan 26, 2024 | 5.11% (0.05110) | 92.19th | v3 (v2023.03.01) |
| Dec 19, 2023 | 2.91% (0.02913) | 89.74th | v3 (v2023.03.01) |
| Nov 11, 2023 | 2.93% (0.02932) | 89.75th | v3 (v2023.03.01) |
| Aug 26, 2023 | 2.91% (0.02909) | 89.49th | v3 (v2023.03.01) |
| Mar 7, 2023 | 3.96% (0.03965) | 90.65th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.93% (0.03932) | 85.88th | v2 (v2022.01.01) |
| Apr 1, 2022 | 3.93% (0.03932) | 84.43th | v2 (v2022.01.01) |
| Feb 4, 2022 | 3.93% (0.03932) | 67.70th | v2 (v2022.01.01) |
Weaknesses (1)
References (58)
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414045 x_refsource_CONFIRMThird Party Advisory
- http://issues.foresightlinux.org/browse/FL-223 x_refsource_CONFIRMBroken Link
- http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory
- http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2007-0125.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://secunia.com/advisories/24739 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24741 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24745 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24756 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24758 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24765 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24771 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24791 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24953 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/24975 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/25004 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/25072 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/25112 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/25131 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/25305 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/25992 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/26177 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/30161 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/33937 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/36260 third-party-advisoryx_refsource_SECUNIAThird Party Advisory
- http://security.gentoo.org/glsa/glsa-200705-06.xml vendor-advisoryx_refsource_GENTOOBroken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102888-1 vendor-advisoryx_refsource_SUNALERTBroken Link
- http://support.apple.com/kb/HT3438 x_refsource_CONFIRMThird Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-176.htm x_refsource_CONFIRMThird Party Advisory
- http://www.debian.org/security/2007/dsa-1294 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- http://www.debian.org/security/2009/dsa-1858 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:079 vendor-advisoryx_refsource_MANDRIVAThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:147 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.novell.com/linux/security/advisories/2007_27_x.html vendor-advisoryx_refsource_SUSEBroken Link
- http://www.novell.com/linux/security/advisories/2007_8_sr.html vendor-advisoryx_refsource_SUSEThird Party Advisory
- http://www.openbsd.org/errata39.html#021_xorg vendor-advisoryx_refsource_OPENBSDThird Party Advisory
- http://www.openbsd.org/errata40.html#011_xorg vendor-advisoryx_refsource_OPENBSDThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0126.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0157.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- http://www.securityfocus.com/archive/1/464686/100/0/threaded mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/464816/100/0/threaded mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/23300 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1017864 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/usn-453-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.ubuntu.com/usn/usn-453-2 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.ubuntu.com/usn/usn-481-1 vendor-advisoryx_refsource_UBUNTUBroken Link
- http://www.vupen.com/english/advisories/2007/1217 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2007/1531 vdb-entryx_refsource_VUPENThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2007-1667 Vendor Advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=231684 x_refsource_CONFIRMIssue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=231684 Issue Tracking
- https://issues.rpath.com/browse/RPL-1211 x_refsource_CONFIRMBroken Link
- https://issues.rpath.com/browse/RPL-1213 x_refsource_CONFIRMBroken Link
- https://nvd.nist.gov/vuln/detail/CVE-2007-1667
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1693 vdb-entrysignaturex_refsource_OVALBroken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9776 vdb-entrysignaturex_refsource_OVALBroken Link
- https://www.cve.org/CVERecord?id=CVE-2007-1667
| Link | Providers | Tags |
|---|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414045 | x_refsource_CONFIRMThird Party Advisory | |
| http://issues.foresightlinux.org/browse/FL-223 | x_refsource_CONFIRMBroken Link | |
| http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html | vendor-advisoryx_refsource_APPLEMailing ListThird Party Advisory | |
| http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| http://rhn.redhat.com/errata/RHSA-2007-0125.html | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| http://secunia.com/advisories/24739 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24741 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24745 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24756 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24758 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24765 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24771 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24791 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24953 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/24975 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/25004 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/25072 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/25112 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/25131 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/25305 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/25992 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/26177 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/30161 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/33937 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/36260 | third-party-advisoryx_refsource_SECUNIAThird Party Advisory | |
| http://security.gentoo.org/glsa/glsa-200705-06.xml | vendor-advisoryx_refsource_GENTOOBroken Link | |
| http://sunsolve.sun.com/search/document.do?assetkey=1-26-102888-1 | vendor-advisoryx_refsource_SUNALERTBroken Link | |
| http://support.apple.com/kb/HT3438 | x_refsource_CONFIRMThird Party Advisory | |
| http://support.avaya.com/elmodocs2/security/ASA-2007-176.htm | x_refsource_CONFIRMThird Party Advisory | |
| http://www.debian.org/security/2007/dsa-1294 | vendor-advisoryx_refsource_DEBIANThird Party Advisory | |
| http://www.debian.org/security/2009/dsa-1858 | vendor-advisoryx_refsource_DEBIANThird Party Advisory | |
| http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:079 | vendor-advisoryx_refsource_MANDRIVAThird Party Advisory | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:147 | vendor-advisoryx_refsource_MANDRIVABroken Link | |
| http://www.novell.com/linux/security/advisories/2007_27_x.html | vendor-advisoryx_refsource_SUSEBroken Link | |
| http://www.novell.com/linux/security/advisories/2007_8_sr.html | vendor-advisoryx_refsource_SUSEThird Party Advisory | |
| http://www.openbsd.org/errata39.html#021_xorg | vendor-advisoryx_refsource_OPENBSDThird Party Advisory | |
| http://www.openbsd.org/errata40.html#011_xorg | vendor-advisoryx_refsource_OPENBSDThird Party Advisory | |
| http://www.redhat.com/support/errata/RHSA-2007-0126.html | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| http://www.redhat.com/support/errata/RHSA-2007-0157.html | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| http://www.securityfocus.com/archive/1/464686/100/0/threaded | mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry | |
| http://www.securityfocus.com/archive/1/464816/100/0/threaded | mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry | |
| http://www.securityfocus.com/bid/23300 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| http://www.securitytracker.com/id?1017864 | vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry | |
| http://www.ubuntu.com/usn/usn-453-1 | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| http://www.ubuntu.com/usn/usn-453-2 | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| http://www.ubuntu.com/usn/usn-481-1 | vendor-advisoryx_refsource_UBUNTUBroken Link | |
| http://www.vupen.com/english/advisories/2007/1217 | vdb-entryx_refsource_VUPENBroken Link | |
| http://www.vupen.com/english/advisories/2007/1531 | vdb-entryx_refsource_VUPENThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2007-1667 | Vendor Advisory | |
| https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=231684 | x_refsource_CONFIRMIssue TrackingThird Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=231684 | Issue Tracking | |
| https://issues.rpath.com/browse/RPL-1211 | x_refsource_CONFIRMBroken Link | |
| https://issues.rpath.com/browse/RPL-1213 | x_refsource_CONFIRMBroken Link | |
| https://nvd.nist.gov/vuln/detail/CVE-2007-1667 | ||
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1693 | vdb-entrysignaturex_refsource_OVALBroken Link | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9776 | vdb-entrysignaturex_refsource_OVALBroken Link | |
| https://www.cve.org/CVERecord?id=CVE-2007-1667 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 24, 2007
Updated Aug 7, 2024
Reserved Mar 24, 2007
Link CVE-2007-1667
CISA Vulnrichment
Updated n/a