CVE-2007-1770 in the critical feed json
Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when us…
published 2007-03-30 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-1764
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 17.0%
- EPSS 17.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB
Summary
Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service (giomgr crash) and execute arbitrary code via long parameters in crafted requests.
Timeline
- Published
- First public exploit (EDB-4146)
Exploit prediction
16.96% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-4146 ESRI ArcSDE 9.0 < 9.2sp1 - Remote Buffer Overflow remote, 2007-07-03
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
support.esri.com
/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=19&MetaID=1261
vendor-advisory
-
support.esri.com
/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=19&MetaID=1262
vendor-advisory
-
support.esri.com
/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=19&MetaID=1260
vendor-advisory
-
securitytracker.com
/id?1017874
vdb-entry, broken-link, third-party-advisory
-
securityfocus.com
/bid/23175
vdb-entry, broken-link, third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/33457
vdb-entry, third-party-advisory
-
secunia.com
/advisories/24639
third-party-advisory, broken-link
-
exchange.xforce.ibmcloud.com
/vulnerabilities/33282
vdb-entry, third-party-advisory
-
labs.idefense.com
/intelligence/vulnerabilities/display.php?id=507
third-party-advisory, broken-link
-
vupen.com
/english/advisories/2007/1140
vdb-entry, broken-link, third-party-advisory
Sources
- CVE List CVE-2007-1770
- NVD CVE-2007-1770
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.