CVE-2007-2237 Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero,....
MediumCVSS 5.5
EPSS 15.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, which triggers a divide-by-zero error.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows xp | All versions | No fix listed |
References
- 38494 broken-link vdb-entry
- www.csis.dk broken-link
- VU#290961 third-party-advisory us-government-resource
- 20070607 CSIS Advisory: Microsoft GDI+ Integer division by zero flaw handling .ICO files broken-link mailing-list third-party-advisory vdb-entry
- 24346 broken-link third-party-advisory vdb-entry
- 1018202 broken-link third-party-advisory vdb-entry
- ADV-2007-2083 broken-link vdb-entry
- windows-gdi-dos(34743) vdb-entry vendor-advisory
- 4044 exploit third-party-advisory vdb-entry