10.0crit
CVE-2004-1308in critical feed
Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via…
Published 21 y ago · modified 4 mo ago · JSON
CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
15.0%
percentile 97%
Public exploits
0
none known
Summary
Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.
Exploit prediction (EPSS)
14.97% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
- redhat.com /support/errata/RHSA-2005-019.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/18637 · vdb-entry, x_refsource_XF, x_transferred
- debian.org /security/2004/dsa-617 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- us-cert.gov /cas/techalerts/TA05-136A.html · third-party-advisory, x_refsource_CERT, x_transferred
- novell.com /linux/security/advisories/2005_01_libtiff_tiff.html · vendor-advisory, x_refsource_SUSE, x_transferred
- sunsolve.sun.com /search/document.do?assetkey=1-66-201072-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
- sunsolve.sun.com /search/document.do?assetkey=1-26-101677-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
- lists.apple.com /archives/security-announce/2005/May/msg00001.html · vendor-advisory, x_refsource_APPLE, x_transferred
- oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9392 · vdb-entry, signature, x_refsource_OVAL, x_transferred
- mandriva.com /security/advisories?name=MDKSA-2005:052 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
- idefense.com /application/poi/display?id=174&type=vulnerabilities · third-party-advisory, x_refsource_IDEFENSE, x_transferred
- kb.cert.org /vuls/id/125598 · third-party-advisory, x_refsource_CERT-VN, x_transferred
- oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100117 · vdb-entry, signature, x_refsource_OVAL, x_transferred
- redhat.com /support/errata/RHSA-2005-035.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000920 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
- secunia.com /advisories/13776 · third-party-advisory, x_refsource_SECUNIA, x_transferred
Sources
- CVE List: CVE-2004-1308
- NVD: CVE-2004-1308
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.