Sign-up

ID

VAR-200412-0007


CVE

CVE-2004-0803


TITLE

LibTIFF contains multiple heap-based buffer overflows

Trust: 0.8

sources: CERT/CC: VU#948752

DESCRIPTION

Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files. libtiff of tif_next.c , tif_thunder.c , tif_luv.c In RLE In the process of decompressing a compressed file, a buffer overflow vulnerability exists due to improper bounds checking.Crafted by a third party TIFF Format image files LibTIFF Interpretation via applications and components that use the library will cause the application to crash and cause denial of service (DoS) It may be possible to run into arbitrary code with the privileges of the target user. LibTIFF is affected by multiple buffer-overflow vulnerabilities because the software fails to properly perform boundary checks before copying user-supplied strings into finite process buffers. An attacker may leverage these issues to execute arbitrary code on a vulnerable computer with the privileges of the user running a vulnerable application, facilitating unauthorized access. The attacker may also leverage these issues to crash the affected application. libtiff is an application library responsible for encoding/decoding TIFF image format. kfax is a small tool for displaying FAX files, using the libtiff library. There is a problem with libtiff when processing fax files. kfax calls the libtiff library to process .g3 files. Attackers can build malformed .g3 files and entice users to process them, which can lead to buffer overflows. Carefully constructed file data may execute arbitrary instructions with user process privileges. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 567-1 security@debian.org http://www.debian.org/security/ Martin Schulze October 15th, 2004 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : tiff Vulnerability : heap overflows Problem-Type : remote Debian-specific: no CVE ID : CAN-2004-0803 CAN-2004-0804 CAN-2004-0886 Several problems have been discovered in libtiff, the Tag Image File Format library for processing TIFF graphics files. CAN-2004-0804 Matthias Clasen discovered a division by zero through an integer overflow. CAN-2004-0886 Dmitry V. Levin discovered several integer overflows that caused malloc issues which can result to either plain crash or memory corruption. For the stable distribution (woody) these problems have been fixed in version 3.5.5-6woody1. For the unstable distribution (sid) these problems have been fixed in version 3.6.1-2. We recommend that you upgrade your libtiff package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-6woody1.dsc Size/MD5 checksum: 635 11a374e916d818c05a373feb04cab6a0 http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-6woody1.diff.gz Size/MD5 checksum: 36717 6f4d137f7c935d57757313a610dbd389 http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5.orig.tar.gz Size/MD5 checksum: 693641 3b7199ba793dec6ca88f38bb0c8cc4d8 Alpha architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_alpha.deb Size/MD5 checksum: 141424 18b6e6b621178c1419de8a13a0a62366 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_alpha.deb Size/MD5 checksum: 105148 875257fb73ba05a575d06650c130a545 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_alpha.deb Size/MD5 checksum: 423194 9796f3e82553cedb237f1b574570f143 ARM architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_arm.deb Size/MD5 checksum: 116928 5ed91b9586d830e8da9a5086fc5a6e76 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_arm.deb Size/MD5 checksum: 90466 f04c381a418fd33602d1ba30158597d3 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_arm.deb Size/MD5 checksum: 404262 30f13bfdf54cfca30ee5ca0f6c6d0e4e Intel IA-32 architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_i386.deb Size/MD5 checksum: 112068 d15dfdf84f010be08799d456726e1d9d http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_i386.deb Size/MD5 checksum: 81054 293f5c99f0a589917257ec7fee0b92fe http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_i386.deb Size/MD5 checksum: 387052 9606adb1668decf5ac1ee02a94298e85 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_ia64.deb Size/MD5 checksum: 158774 80c1b7ad68ecc78091ea95414125e81c http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_ia64.deb Size/MD5 checksum: 135386 b17f87aa0ad98fc50aa8c137a6f5089c http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_ia64.deb Size/MD5 checksum: 446496 757f3b6cc9d3f1ec5a2dfb1c3485caf3 HP Precision architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_hppa.deb Size/MD5 checksum: 128298 46dece015f0282bca0af7f6e740e9d31 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_hppa.deb Size/MD5 checksum: 106788 b837005b41c54c341cbd61e8fdb581ff http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_hppa.deb Size/MD5 checksum: 420346 3a2b91ee22af99eec3ab42d81cf9d59f Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_m68k.deb Size/MD5 checksum: 107302 0c702a3e5c2ad7ad7bd96dae64fa2d61 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_m68k.deb Size/MD5 checksum: 79770 d67f4347d35bf898a6ab1914cb53a42f http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_m68k.deb Size/MD5 checksum: 380218 42e6f07cf2e70de01ca40ac4a97254bf Big endian MIPS architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_mips.deb Size/MD5 checksum: 124048 85d8c8cbb62cc62c876bf4ed721027cf http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_mips.deb Size/MD5 checksum: 87840 5f3312f22b0f345c7eae434f5b871993 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_mips.deb Size/MD5 checksum: 410770 be817ddffa91c423b55fda3388d7ce48 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_mipsel.deb Size/MD5 checksum: 123558 42594e9270de16ff802c11eccf7a0efb http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_mipsel.deb Size/MD5 checksum: 88198 a8f0abe9205431caf94dce77d11ac477 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_mipsel.deb Size/MD5 checksum: 410860 68a12ef6d37fc575105c4ceb9b766949 PowerPC architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_powerpc.deb Size/MD5 checksum: 116042 2258da94549ae05ffae643bc40790487 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_powerpc.deb Size/MD5 checksum: 89424 c8d782561a299ffb65ea84b59d88117a http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_powerpc.deb Size/MD5 checksum: 402372 1eca24adda52b40c7a8d789fdeb3cb2e IBM S/390 architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_s390.deb Size/MD5 checksum: 116870 dcddc86a0d96296c07076391adc9d754 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_s390.deb Size/MD5 checksum: 91742 40c1de704b191e4abb65af8a4b7fd75d http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_s390.deb Size/MD5 checksum: 395332 86d351b75f1f146ddad6d562ca77005c Sun Sparc architecture: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_sparc.deb Size/MD5 checksum: 132888 9ed9db78d727ba8bfbb25c1e68b03bf2 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_sparc.deb Size/MD5 checksum: 88556 a4069600bd9295a27d4eb6e9e0995495 http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_sparc.deb Size/MD5 checksum: 397026 149e12055c5711129552fa938b5af431 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBcA4UW5ql+IAeqTIRAgMFAKC3Kbs2MxW5XlOa3aK9oo76W8wt9gCfXzyA fD+15yHAK6bw15bB4ejaGV8= =KPqY -----END PGP SIGNATURE-----

Trust: 2.79

sources: NVD: CVE-2004-0803 // CERT/CC: VU#948752 // JVNDB: JVNDB-2004-000443 // BID: 11406 // VULHUB: VHN-9233 // PACKETSTORM: 34737

AFFECTED PRODUCTS

vendor:redhatmodel:enterprise linuxscope:eqversion:2.1

Trust: 1.6

vendor:redhatmodel:enterprise linuxscope:eqversion:3.0

Trust: 1.6

vendor:trustixmodel:secure linuxscope:eqversion:2.1

Trust: 1.3

vendor:trustixmodel:secure linuxscope:eqversion:2.0

Trust: 1.3

vendor:trustixmodel:secure linuxscope:eqversion:1.5

Trust: 1.3

vendor:susemodel:linuxscope:eqversion:8.1

Trust: 1.3

vendor:pdflibmodel:pdf libraryscope:eqversion:5.0.2

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.6.1

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.6.0

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.5.7

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.5.5

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.5.4

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.5.3

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.5.2

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.5.1

Trust: 1.3

vendor:libtiffmodel:libtiffscope:eqversion:3.4

Trust: 1.3

vendor:kdemodel:kdescope:eqversion:3.3.1

Trust: 1.3

vendor:kdemodel:kdescope:eqversion:3.3

Trust: 1.3

vendor:kdemodel:kdescope:eqversion:3.2.3

Trust: 1.3

vendor:kdemodel:kdescope:eqversion:3.2.2

Trust: 1.3

vendor:kdemodel:kdescope:eqversion:3.2.1

Trust: 1.3

vendor:kdemodel:kdescope:eqversion:3.2

Trust: 1.3

vendor:applemodel:mac os x serverscope:eqversion:10.2.8

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.6

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.5

Trust: 1.0

vendor:redhatmodel:fedora corescope:eqversion:core_2.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.5

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.6

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:1.0

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:9.1

Trust: 1.0

vendor:redhatmodel:enterprise linux desktopscope:eqversion:3.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.6

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.1

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.6

Trust: 1.0

vendor:wxgtk2model:wxgtk2scope:eqversion:2.5_.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.1

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.4

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.3

Trust: 1.0

vendor:mandrakesoftmodel:mandrake linuxscope:eqversion:10.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.5

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.4

Trust: 1.0

vendor:redhatmodel:linux advanced workstationscope:eqversion:2.1

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.7

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2.7

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.2

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:8

Trust: 1.0

vendor:susemodel:linuxscope:eqversion:8.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.2.8

Trust: 1.0

vendor:apple computermodel: - scope: - version: -

Trust: 0.8

vendor:debianmodel: - scope: - version: -

Trust: 0.8

vendor:cybertrustmodel:asianux serverscope:eqversion:2.0

Trust: 0.8

vendor:cybertrustmodel:asianux serverscope:eqversion:2.1

Trust: 0.8

vendor:cybertrustmodel:asianux serverscope:eqversion:3.0

Trust: 0.8

vendor:cybertrustmodel:asianux serverscope:eqversion:3.0 (x86-64)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:10 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:10 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:7.0 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:7.0 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:8 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:8 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:9 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:9 (x86)

Trust: 0.8

vendor:turbo linuxmodel:turbolinuxscope:eqversion:10_f

Trust: 0.8

vendor:turbo linuxmodel:turbolinux appliance serverscope:eqversion:1.0 (hosting)

Trust: 0.8

vendor:turbo linuxmodel:turbolinux appliance serverscope:eqversion:1.0 (workgroup)

Trust: 0.8

vendor:turbo linuxmodel:turbolinux desktopscope:eqversion:10

Trust: 0.8

vendor:turbo linuxmodel:turbolinux serverscope:eqversion:10

Trust: 0.8

vendor:turbo linuxmodel:turbolinux serverscope:eqversion:7

Trust: 0.8

vendor:turbo linuxmodel:turbolinux serverscope:eqversion:8

Trust: 0.8

vendor:turbo linuxmodel:turbolinux workstationscope:eqversion:7

Trust: 0.8

vendor:turbo linuxmodel:turbolinux workstationscope:eqversion:8

Trust: 0.8

vendor:turbo linuxmodel:homescope: - version: -

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (as)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (es)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (ws)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (as)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (es)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (ws)

Trust: 0.8

vendor:red hatmodel:enterprise linux desktopscope:eqversion:3.0

Trust: 0.8

vendor:red hatmodel:linux advanced workstationscope:eqversion:2.1

Trust: 0.8

vendor:wxgtk2model:wxgtk2scope:eqversion:2.5.0

Trust: 0.3

vendor:wxgtk2model:wxgtk2scope: - version: -

Trust: 0.3

vendor:trustixmodel:secure enterprise linuxscope:eqversion:2.0

Trust: 0.3

vendor:tetexmodel:tetexscope:eqversion:1.0.7

Trust: 0.3

vendor:tetexmodel:tetexscope:eqversion:1.0.6

Trust: 0.3

vendor:susemodel:linux enterprise serverscope:eqversion:8

Trust: 0.3

vendor:susemodel:linux enterprise serverscope:eqversion:9

Trust: 0.3

vendor:susemodel:linux desktopscope:eqversion:1.0

Trust: 0.3

vendor:sunmodel:solaris 9 x86 updatescope:eqversion:2

Trust: 0.3

vendor:sunmodel:solaris 9 x86scope: - version: -

Trust: 0.3

vendor:sunmodel:solarisscope:eqversion:9

Trust: 0.3

vendor:sunmodel:solaris 8 x86scope: - version: -

Trust: 0.3

vendor:sunmodel:solaris 8 sparcscope: - version: -

Trust: 0.3

vendor:sunmodel:solaris 7.0 x86scope: - version: -

Trust: 0.3

vendor:sunmodel:solarisscope:eqversion:7.0

Trust: 0.3

vendor:sunmodel:solaris 10 x86scope: - version: -

Trust: 0.3

vendor:sunmodel:solaris 10.0 x86scope: - version: -

Trust: 0.3

vendor:sunmodel:solarisscope:eqversion:10

Trust: 0.3

vendor:sgimodel:propackscope:eqversion:3.0

Trust: 0.3

vendor:scomodel:unixwarescope:eqversion:7.1.4

Trust: 0.3

vendor:s u s emodel:linux personalscope:eqversion:9.1

Trust: 0.3

vendor:s u s emodel:linux personalscope:eqversion:9.0

Trust: 0.3

vendor:s u s emodel:linux personalscope:eqversion:8.2

Trust: 0.3

vendor:redhatmodel:fedora core2scope: - version: -

Trust: 0.3

vendor:redhatmodel:enterprise linux wsscope:eqversion:3

Trust: 0.3

vendor:redhatmodel:enterprise linux ws ia64scope:eqversion:2.1

Trust: 0.3

vendor:redhatmodel:enterprise linux wsscope:eqversion:2.1

Trust: 0.3

vendor:redhatmodel:enterprise linux esscope:eqversion:3

Trust: 0.3

vendor:redhatmodel:enterprise linux es ia64scope:eqversion:2.1

Trust: 0.3

vendor:redhatmodel:enterprise linux esscope:eqversion:2.1

Trust: 0.3

vendor:redhatmodel:enterprise linux asscope:eqversion:3

Trust: 0.3

vendor:redhatmodel:enterprise linux as ia64scope:eqversion:2.1

Trust: 0.3

vendor:redhatmodel:enterprise linux asscope:eqversion:2.1

Trust: 0.3

vendor:redhatmodel:desktopscope:eqversion:3.0

Trust: 0.3

vendor:redhatmodel:advanced workstation for the itanium processor ia64scope:eqversion:2.1

Trust: 0.3

vendor:redhatmodel:advanced workstation for the itanium processorscope:eqversion:2.1

Trust: 0.3

vendor:mandrivamodel:linux mandrake amd64scope:eqversion:10.0

Trust: 0.3

vendor:mandrivamodel:linux mandrakescope:eqversion:10.0

Trust: 0.3

vendor:mandrakesoftmodel:corporate server x86 64scope:eqversion:3.0

Trust: 0.3

vendor:mandrakesoftmodel:corporate serverscope:eqversion:3.0

Trust: 0.3

vendor:libtiffmodel:do not usescope: - version: -

Trust: 0.3

vendor:avayamodel:modular messagingscope:eqversion:2.0

Trust: 0.3

vendor:avayamodel:modular messagingscope:eqversion:1.1

Trust: 0.3

vendor:avayamodel:modular messaging s3400scope: - version: -

Trust: 0.3

vendor:avayamodel:mn100scope: - version: -

Trust: 0.3

vendor:avayamodel:intuity lxscope: - version: -

Trust: 0.3

vendor:avayamodel:integrated managementscope: - version: -

Trust: 0.3

vendor:avayamodel:cvlanscope: - version: -

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.5

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.8

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2

Trust: 0.3

vendor:pdflibmodel:pdf library p1scope:neversion:5.0.4

Trust: 0.3

vendor:kdemodel:kdescope:neversion:3.3.2

Trust: 0.3

sources: CERT/CC: VU#948752 // BID: 11406 // JVNDB: JVNDB-2004-000443 // CNNVD: CNNVD-200412-097 // NVD: CVE-2004-0803

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-0803
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#948752
value: 7.43

Trust: 0.8

NVD: CVE-2004-0803
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200412-097
value: HIGH

Trust: 0.6

VULHUB: VHN-9233
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2004-0803
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-9233
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#948752 // VULHUB: VHN-9233 // JVNDB: JVNDB-2004-000443 // CNNVD: CNNVD-200412-097 // NVD: CVE-2004-0803

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2004-0803

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200412-097

TYPE

Boundary Condition Error

Trust: 0.9

sources: BID: 11406 // CNNVD: CNNVD-200412-097

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2004-000443

PATCH
title:libtiffurl:http://www.miraclelinux.com/support/update/data/libtiff.html
Trust: 0.8
title:AXSA-2005-62:1url:http://www.miraclelinux.com/support/update/list.php?errata_id=184
Trust: 0.8
title:RHSA-2005:021url:https://rhn.redhat.com/errata/RHSA-2005-021.html
Trust: 0.8
title:RHSA-2005:354url:https://rhn.redhat.com/errata/RHSA-2005-354.html
Trust: 0.8
title:RHSA-2004:577url:http://rhn.redhat.com/errata/RHSA-2004-577.html
Trust: 0.8
title:101677url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
Trust: 0.8
title:TLSA-2005-4url:http://www.turbolinux.com/security/2005/TLSA-2005-4.txt
Trust: 0.8
title:RHSA-2005:021url:http://www.jp.redhat.com/support/errata/RHSA/RHSA-2005-021J.html
Trust: 0.8
title:RHSA-2005:354url:http://www.jp.redhat.com/support/errata/RHSA/RHSA-2005-354J.html
Trust: 0.8
title:RHSA-2004:577url:http://www.jp.redhat.com/support/errata/RHSA/RHSA-2004-577J.html
Trust: 0.8
title:TLSA-2005-4url:http://www.turbolinux.co.jp/security/2005/TLSA-2005-4j.txt
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2004-000443

EXTERNAL IDS
db:NVDid:CVE-2004-0803
Trust: 3.8
db:CERT/CCid:VU#948752
Trust: 3.3
db:BIDid:11406
Trust: 2.8
db:SECUNIAid:12818
Trust: 2.5
db:XFid:17703
Trust: 1.4
db:SECTRACKid:1011667
Trust: 0.8
db:OSVDBid:10750
Trust: 0.8
db:JVNDBid:JVNDB-2004-000443
Trust: 0.8
db:CNNVDid:CNNVD-200412-097
Trust: 0.7
db:OVALid:OVAL:ORG.MITRE.OVAL:DEF:100114
Trust: 0.6
db:OVALid:OVAL:ORG.MITRE.OVAL:DEF:8896
Trust: 0.6
db:SUSEid:SUSE-SA:2004:038
Trust: 0.6
db:MANDRAKEid:MDKSA-2004:109
Trust: 0.6
db:MANDRAKEid:MDKSA-2005:052
Trust: 0.6
db:SUNALERTid:101677
Trust: 0.6
db:SUNALERTid:201072
Trust: 0.6
db:GENTOOid:GLSA-200410-11
Trust: 0.6
db:REDHATid:RHSA-2005:021
Trust: 0.6
db:REDHATid:RHSA-2004:577
Trust: 0.6
db:REDHATid:RHSA-2005:354
Trust: 0.6
db:BUGTRAQid:20041013 CESA-2004-006: LIBTIFF
Trust: 0.6
db:CONECTIVAid:CLA-2004:888
Trust: 0.6
db:DEBIANid:DSA-567
Trust: 0.6
db:PACKETSTORMid:34684
Trust: 0.2
db:PACKETSTORMid:34737
Trust: 0.2
db:VULHUBid:VHN-9233
Trust: 0.1
sources:
            
            
            CERT/CC: VU#948752 // 
            
            
            
            VULHUB: VHN-9233 // 
            
            
            
            BID: 11406 // 
            
            
            
            JVNDB: JVNDB-2004-000443 // 
            
            
            
            PACKETSTORM: 34684 // 
            
            
            
            PACKETSTORM: 34737 // 
            
            
            
            CNNVD: CNNVD-200412-097 // 
            
            
            
            NVD: CVE-2004-0803

REFERENCES
url:http://scary.beasts.org/security/cesa-2004-006.txt
Trust: 2.5
url:http://www.securityfocus.com/bid/11406
Trust: 2.5
url:http://www.kb.cert.org/vuls/id/948752
Trust: 2.5
url:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
Trust: 2.0
url:http://www.kde.org/info/security/advisory-20041209-2.txt
Trust: 1.7
url:http://www.debian.org/security/2004/dsa-567
Trust: 1.7
url:http://www.gentoo.org/security/en/glsa/glsa-200410-11.xml
Trust: 1.7
url:http://www.mandriva.com/security/advisories?name=mdksa-2004:109
Trust: 1.7
url:http://www.mandriva.com/security/advisories?name=mdksa-2005:052
Trust: 1.7
url:http://www.redhat.com/support/errata/rhsa-2004-577.html
Trust: 1.7
url:http://www.redhat.com/support/errata/rhsa-2005-021.html
Trust: 1.7
url:http://www.redhat.com/support/errata/rhsa-2005-354.html
Trust: 1.7
url:http://secunia.com/advisories/12818
Trust: 1.7
url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
Trust: 1.7
url:http://www.novell.com/linux/security/advisories/2004_38_libtiff.html
Trust: 1.7
url:http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000888
Trust: 1.6
url:http://xforce.iss.net/xforce/xfdb/17703
Trust: 1.4
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a100114
Trust: 1.1
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a8896
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/17703
Trust: 1.1
url:http://marc.info/?l=bugtraq&m=109778785107450&w=2
Trust: 1.0
url:http://securitytracker.com/alerts/2004/oct/1011667.html
Trust: 0.8
url:http://www.osvdb.org/displayvuln.php?osvdb_id=10750
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2004-0803
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-0803
Trust: 0.8
url:http://jvn.jp/cert/jvnvu%23948752
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-0803
Trust: 0.8
url:http://secunia.com/advisories/12818/
Trust: 0.8
url:http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:8896
Trust: 0.6
url:http://marc.theaimsgroup.com/?l=bugtraq&m=109778785107450&w=2
Trust: 0.6
url:http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:100114
Trust: 0.6
url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-57769-1
Trust: 0.3
url:http://www.libtiff.org/
Trust: 0.3
url:http://rhn.redhat.com/errata/rhsa-2004-577.html
Trust: 0.3
url:http://rhn.redhat.com/errata/rhsa-2005-021.html
Trust: 0.3
url:http://rhn.redhat.com/errata/rhsa-2005-354.html
Trust: 0.3
url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1&searchclause=
Trust: 0.3
url:http://support.avaya.com/elmodocs2/security/asa-2005-002_rhsa-2004-577.pdf
Trust: 0.3
url:/archive/1/378421
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2004-0803
Trust: 0.2
url:http://marc.info/?l=bugtraq&amp;m=109778785107450&amp;w=2
Trust: 0.1
url:http://distro.conectiva.com.br/atualizacoes/index.php?id=a&amp;anuncio=000888
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_s390.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_i386.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_alpha.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_hppa.deb
Trust: 0.1
url:http://www.debian.org/security/faq
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_hppa.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_alpha.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_mipsel.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_ia64.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_powerpc.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_hppa.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_sparc.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-6woody1.dsc
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_arm.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_mips.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_mipsel.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_s390.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_ia64.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_i386.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_mips.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_mipsel.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_mips.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_m68k.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-6woody1.diff.gz
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_powerpc.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_powerpc.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_arm.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_i386.deb
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2004-0804
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5.orig.tar.gz
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_ia64.deb
Trust: 0.1
url:http://packages.debian.org/<pkg>
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_s390.deb
Trust: 0.1
url:http://security.debian.org/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2004-0886
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_sparc.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_m68k.deb
Trust: 0.1
url:http://www.debian.org/security/
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-6woody1_alpha.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_arm.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-6woody1_sparc.deb
Trust: 0.1
url:http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-6woody1_m68k.deb
Trust: 0.1
sources:
            
            
            CERT/CC: VU#948752 // 
            
            
            
            VULHUB: VHN-9233 // 
            
            
            
            BID: 11406 // 
            
            
            
            JVNDB: JVNDB-2004-000443 // 
            
            
            
            PACKETSTORM: 34684 // 
            
            
            
            PACKETSTORM: 34737 // 
            
            
            
            CNNVD: CNNVD-200412-097 // 
            
            
            
            NVD: CVE-2004-0803

CREDITS
Chris Evans※ chris@ferret.lmh.ox.ac.uk
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200412-097

SOURCES
db:CERT/CCid:VU#948752
db:VULHUBid:VHN-9233
db:BIDid:11406
db:JVNDBid:JVNDB-2004-000443
db:PACKETSTORMid:34684
db:PACKETSTORMid:34737
db:CNNVDid:CNNVD-200412-097
db:NVDid:CVE-2004-0803

LAST UPDATE DATE
2024-08-14T12:14:51.606000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#948752date:2005-03-17T00:00:00
db:VULHUBid:VHN-9233date:2017-10-11T00:00:00
db:BIDid:11406date:2009-05-05T15:46:00
db:JVNDBid:JVNDB-2004-000443date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200412-097date:2009-02-05T00:00:00
db:NVDid:CVE-2004-0803date:2017-10-11T01:29:34.373

SOURCES RELEASE DATE
db:CERT/CCid:VU#948752date:2004-12-01T00:00:00
db:VULHUBid:VHN-9233date:2004-12-23T00:00:00
db:BIDid:11406date:2004-10-13T00:00:00
db:JVNDBid:JVNDB-2004-000443date:2007-04-01T00:00:00
db:PACKETSTORMid:34684date:2004-10-20T02:32:00
db:PACKETSTORMid:34737date:2004-10-26T02:30:56
db:CNNVDid:CNNVD-200412-097date:2004-10-14T00:00:00
db:NVDid:CVE-2004-0803date:2004-12-23T05:00:00