GHSA-q7x4-hch5-5w3x

GHSA-q7x4-hch5-5w3x PUBLISHED CVSS 9.300000190734863 CRITICAL

Record from GitHub Advisory Database · Published May 2, 2022

Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers to access files or execute arbitrary code via (1) a crafted PNG image that triggers an integer overflow during memory allocation for display on the splash screen, aka CR 6804996; and (2) a crafted GIF image from which unspecified values are used in calculation of offsets, leading to object-pointer corruption, aka CR 6804997.

Risk scores

CVSS 4.0

9.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Timeline

May 2, 2022 CVE Published
Apr 9, 2026 Distribution Patch (2 in total, the first dated here)
Apr 9, 2026 Security Advisory (3 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-q7x4-hch5-5w3x
vulnetix vdb fixes GHSA-q7x4-hch5-5w3x

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-q7x4-hch5-5w3x/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 20 more

Look up in the Resolve Platform →