CVE-2007-5507
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+...
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size, which triggers a buffer over-read, aka DB22.
Exploit likelihood
What each source reports
NVD Score used
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size, which triggers a buffer over-read, aka DB22.
- Record
CVE-2007-5507- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-20, CWE-119
- Updated
- 2026-11-02
CVE List No score
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size, which triggers a buffer over-read, aka DB22.
- Record
CVE-2007-5507- Updated
- 2026-11-02
EUVDEUVD-2007-5482 No score
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size, which triggers a buffer over-read, aka DB22.
- Record
EUVD-2007-5482- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jq9h-634g-v84w No score
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+...
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a connect GIOP packet with an invalid data size, which triggers a buffer over-read, aka DB22.
- Record
GHSA-jq9h-634g-v84w- Weakness
- CWE-20, CWE-119
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5507 is a medium vulnerability (CVSS 6.4) in Oracle Database Server, published October 17, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.76%, the 86th percentile. No source names a fixed version.
References
oracle.com/technetwork/topics/security/cpuoct2007-092913.html
securityfocus.com/archive/1/482423/100/0/threaded
vupen.com/english/advisories/2007/3524
us-cert.gov/cas/techalerts/TA07-290A.html
marc.info?l=bugtraq&m=119332677525918&w=2
Show 8 moreShow less
ngssoftware.com/advisories/high-risk-vulnerability-in-oracle-tns-listener
securitytracker.com/id?1018823
securityreason.com/securityalert/3250
secunia.com/advisories/27409
nvd.nist.gov/vuln/detail/CVE-2007-5507
github.com/advisories/GHSA-jq9h-634g-v84w