CVE-2004-1308 Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directo...
HighCVSS 10.0
EPSS 15.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libtiff | = 3.4 | No fix listed |
| libtiff | = 3.5.1 | No fix listed |
| libtiff | = 3.5.2 | No fix listed |
| libtiff | = 3.5.3 | No fix listed |
| libtiff | = 3.5.4 | No fix listed |
| libtiff | = 3.5.5 | No fix listed |
| libtiff | = 3.5.7 | No fix listed |
| libtiff | = 3.6.0 | No fix listed |
| libtiff | = 3.6.1 | No fix listed |
| libtiff | = 3.7.0 | No fix listed |
| debian/tiff(Debian:12) | < 3.6.1-4 | 3.6.1-4 |
| debian/tiff(Debian:13) | < 3.6.1-4 | 3.6.1-4 |
| debian/tiff(Debian:14) | < 3.6.1-4 | 3.6.1-4 |
References
- CLA-2005:920 vendor-advisory
- APPLE-SA-2005-05-03 vendor-advisory
- 13776 third-party-advisory
- 101677 vendor-advisory
- 201072 vendor-advisory
- DSA-617 vendor-advisory
- 20041221 libtiff Directory Entry Count Integer Overflow Vulnerability exploit patch third-party-advisory vendor-advisory
- VU#125598 third-party-advisory us-government-resource
- MDKSA-2005:052 vendor-advisory
- SUSE-SA:2005:001 vendor-advisory
- RHSA-2005:019 vendor-advisory
- RHSA-2005:035 vendor-advisory
- TA05-136A third-party-advisory us-government-resource
- libtiff-tiff-tdircount-bo(18637) vdb-entry
- oval:org.mitre.oval:def:100117 signature vdb-entry
- oval:org.mitre.oval:def:9392 signature vdb-entry
- Debian Security Tracker CVE-2004-1308 vendor-advisory