PT-2004-1065 · Libtiff+1 · Libtiff+1

Infamous41Md · Published 2004-12-22 · Updated 2017-10-11 · CVE-2004-1308

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libtiff versions 3.5.5 through 3.7.0

Description The issue allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF ASCII or TIFF UNDEFINED directory entry with a -1 entry count, leading to a heap-based buffer overflow. This can result in disruption of confidentiality, integrity, and availability of protected information. The exploitation of these issues can be done remotely.

Recommendations For libtiff versions 3.5.5 through 3.7.0, update to a version that contains a fix for this issue to prevent remote code execution and protect against potential disruptions to confidentiality, integrity, and availability of protected information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-06336

BDU:2015-06341

CVE-2004-1308

DSA-617-1

RHSA-2005:019

RHSA-2005:021

RHSA-2005:035

RHSA-2005_019

RHSA-2005_021

RHSA-2005_035

Affected Products

Red Hat

Libtiff

References · 32

• 🔥 http://idefense.com/application/poi/display?id=174&type=vulnerabilities · Exploit
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000920 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-1308 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-019.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06336 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:052 · Vendor Advisory
• http://debian.org/security/2004/dsa-617 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-035.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_01_libtiff_tiff.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-1308 · Security Note
• http://lists.apple.com/archives/security-announce/2005/May/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-1308 · Vendor Advisory