CVE-2004-1307 Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number....
HighCVSS 7.5
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya call management system server | = 8.0 | No fix listed |
| avaya call management system server | = 9.0 | No fix listed |
| avaya call management system server | = 11.0 | No fix listed |
| avaya call management system server | = 12.0 | No fix listed |
| avaya call management system server | = 13.0 | No fix listed |
| avaya cvlan | All versions | No fix listed |
| avaya integrated management | All versions | No fix listed |
| avaya interactive response | All versions | No fix listed |
| avaya interactive response | = 1.2.1 | No fix listed |
| avaya interactive response | = 1.3 | No fix listed |
| avaya intuity audix lx | All versions | No fix listed |
| f5 icontrol service manager | = 1.3 | No fix listed |
| f5 icontrol service manager | = 1.3.4 | No fix listed |
| f5 icontrol service manager | = 1.3.5 | No fix listed |
| f5 icontrol service manager | = 1.3.6 | No fix listed |
| libtiff | = 3.4 | No fix listed |
| libtiff | = 3.5.1 | No fix listed |
| libtiff | = 3.5.2 | No fix listed |
| libtiff | = 3.5.3 | No fix listed |
| libtiff | = 3.5.4 | No fix listed |
| libtiff | = 3.5.5 | No fix listed |
| libtiff | = 3.5.7 | No fix listed |
| libtiff | = 3.6.0 | No fix listed |
| libtiff | = 3.6.1 | No fix listed |
| libtiff | = 3.7.0 | No fix listed |
Show 41 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sgi propack | = 3.0 | No fix listed |
| conectiva linux | = 9.0 | No fix listed |
| conectiva linux | = 10.0 | No fix listed |
| avaya mn100 | All versions | No fix listed |
| apple mac os x | = 10.3 | No fix listed |
| apple mac os x | = 10.3.1 | No fix listed |
| apple mac os x | = 10.3.2 | No fix listed |
| apple mac os x | = 10.3.3 | No fix listed |
| apple mac os x | = 10.3.4 | No fix listed |
| apple mac os x | = 10.3.5 | No fix listed |
| apple mac os x | = 10.3.6 | No fix listed |
| apple mac os x | = 10.3.7 | No fix listed |
| apple mac os x | = 10.3.8 | No fix listed |
| apple mac os x | = 10.3.9 | No fix listed |
| apple mac os x server | = 10.3 | No fix listed |
| apple mac os x server | = 10.3.1 | No fix listed |
| apple mac os x server | = 10.3.2 | No fix listed |
| apple mac os x server | = 10.3.3 | No fix listed |
| apple mac os x server | = 10.3.4 | No fix listed |
| apple mac os x server | = 10.3.5 | No fix listed |
| apple mac os x server | = 10.3.6 | No fix listed |
| apple mac os x server | = 10.3.7 | No fix listed |
| apple mac os x server | = 10.3.8 | No fix listed |
| apple mac os x server | = 10.3.9 | No fix listed |
| avaya modular messaging message storage server | = 1.1 | No fix listed |
| avaya modular messaging message storage server | = 2.0 | No fix listed |
| gentoo linux | All versions | No fix listed |
| mandrakesoft mandrake linux | = 10.0 | No fix listed |
| mandrakesoft mandrake linux | = 10.1 | No fix listed |
| mandrakesoft mandrake linux corporate server | = 3.0 | No fix listed |
| sco unixware | = 7.1.4 | No fix listed |
| sun solaris | = 7.0 | No fix listed |
| sun solaris | = 8.0 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
| sun solaris | = 9.0-x86_update_2 | No fix listed |
| sun solaris | = 10.0 | No fix listed |
| sunos | = 5.7 | No fix listed |
| sunos | = 5.8 | No fix listed |
| debian/tiff(Debian:12) | < 3.7.0 | 3.7.0 |
| debian/tiff(Debian:13) | < 3.7.0 | 3.7.0 |
| debian/tiff(Debian:14) | < 3.7.0 | 3.7.0 |
References
- APPLE-SA-2005-05-03 patch vendor-advisory
- 101677 vendor-advisory
- 201072 vendor-advisory
- 20041221 libtiff STRIPOFFSETS Integer Overflow Vulnerability patch third-party-advisory vendor-advisory
- VU#539110 patch third-party-advisory us-government-resource
- TA05-136A third-party-advisory us-government-resource
- oval:org.mitre.oval:def:11175 signature vdb-entry
- Debian Security Tracker CVE-2004-1307 vendor-advisory