Read the docs
TI-2004-01185 Aliases CVE-2004-1307GHSA-j2r4-vwhq-m2gg

Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1…

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.

Why it matters now

EPSS 0.0634 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 68

CPEVersionsRoleVendor
cpe:2.3:a:avaya:call_management_system_server:8.0:*:*:*:*:*:*:*8.0VulnerableAvaya
cpe:2.3:a:avaya:call_management_system_server:9.0:*:*:*:*:*:*:*9.0VulnerableAvaya
cpe:2.3:a:avaya:call_management_system_server:11.0:*:*:*:*:*:*:*11.0VulnerableAvaya
cpe:2.3:a:avaya:call_management_system_server:12.0:*:*:*:*:*:*:*12.0VulnerableAvaya
cpe:2.3:a:avaya:call_management_system_server:13.0:*:*:*:*:*:*:*13.0VulnerableAvaya
cpe:2.3:a:avaya:cvlan:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:a:avaya:integrated_management:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:a:avaya:interactive_response:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:a:avaya:interactive_response:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableAvaya
cpe:2.3:a:avaya:interactive_response:1.3:*:*:*:*:*:*:*1.3VulnerableAvaya
  • cpe:2.3:a:avaya:call_management_system_server:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:call_management_system_server:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:call_management_system_server:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:call_management_system_server:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:call_management_system_server:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:cvlan:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:a:avaya:integrated_management:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:a:avaya:interactive_response:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:a:avaya:interactive_response:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:interactive_response:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Avaya
Show 58 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:avaya:intuity_audix_lx:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:a:f5:icontrol_service_manager:1.3:*:*:*:*:*:*:*1.3VulnerableF5
cpe:2.3:a:f5:icontrol_service_manager:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableF5
cpe:2.3:a:f5:icontrol_service_manager:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableF5
cpe:2.3:a:f5:icontrol_service_manager:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableF5
cpe:2.3:a:libtiff:libtiff:3.4:*:*:*:*:*:*:*3.4Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.5.1:*:*:*:*:*:*:*3.5.1Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.5.2:*:*:*:*:*:*:*3.5.2Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.5.3:*:*:*:*:*:*:*3.5.3Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.5.4:*:*:*:*:*:*:*3.5.4Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.5.5:*:*:*:*:*:*:*3.5.5Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.5.7:*:*:*:*:*:*:*3.5.7Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.6.0:*:*:*:*:*:*:*3.6.0Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.6.1:*:*:*:*:*:*:*3.6.1Vulnerablelibtiff
cpe:2.3:a:libtiff:libtiff:3.7.0:*:*:*:*:*:*:*3.7.0Vulnerablelibtiff
cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*3.0VulnerableSgi
cpe:2.3:o:conectiva:linux:9.0:*:*:*:*:*:*:*9.0VulnerableConectiva
cpe:2.3:o:conectiva:linux:10.0:*:*:*:*:*:*:*10.0VulnerableConectiva
cpe:2.3:a:avaya:mn100:*:*:*:*:*:*:*:*all versionsVulnerableAvaya
cpe:2.3:o:apple:mac_os_x:10.3:*:*:*:*:*:*:*10.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.1:*:*:*:*:*:*:*10.3.1VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.2:*:*:*:*:*:*:*10.3.2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.3:*:*:*:*:*:*:*10.3.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.4:*:*:*:*:*:*:*10.3.4VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.5:*:*:*:*:*:*:*10.3.5VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.6:*:*:*:*:*:*:*10.3.6VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.7:*:*:*:*:*:*:*10.3.7VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.8:*:*:*:*:*:*:*10.3.8VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*10.3.9VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3:*:*:*:*:*:*:*10.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.1:*:*:*:*:*:*:*10.3.1VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.2:*:*:*:*:*:*:*10.3.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.3:*:*:*:*:*:*:*10.3.3VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.4:*:*:*:*:*:*:*10.3.4VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.5:*:*:*:*:*:*:*10.3.5VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.6:*:*:*:*:*:*:*10.3.6VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.7:*:*:*:*:*:*:*10.3.7VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.8:*:*:*:*:*:*:*10.3.8VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:10.3.9:*:*:*:*:*:*:*10.3.9VulnerableApple
cpe:2.3:o:avaya:modular_messaging_message_storage_server:1.1:*:*:*:*:*:*:*1.1VulnerableAvaya
cpe:2.3:o:avaya:modular_messaging_message_storage_server:2.0:*:*:*:*:*:*:*2.0VulnerableAvaya
cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:*all versionsVulnerablegentoo
cpe:2.3:o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*10.0VulnerableMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:10.0:*:amd64:*:*:*:*:*10.0VulnerableMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*10.1VulnerableMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:*:x86_64:*:*:*:*:*10.1VulnerableMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*3.0VulnerableMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:x86_64:*:*:*:*:*3.0VulnerableMandrakesoft
cpe:2.3:o:sco:unixware:7.1.4:*:*:*:*:*:*:*7.1.4VulnerableSco
cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:*7.0VulnerableSun
cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:*8.0VulnerableSun
cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*9.0VulnerableSun
cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*9.0VulnerableSun
cpe:2.3:o:sun:solaris:9.0:x86_update_2:*:*:*:*:*:*9.0 x86_update_2VulnerableSun
cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:*10.0VulnerableSun
cpe:2.3:o:sun:solaris:10.0:*:x86:*:*:*:*:*10.0VulnerableSun
cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:*5.7VulnerableSun
cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*5.8VulnerableSun
  • cpe:2.3:a:avaya:intuity_audix_lx:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:a:f5:icontrol_service_manager:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·F5
  • cpe:2.3:a:f5:icontrol_service_manager:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·F5
  • cpe:2.3:a:f5:icontrol_service_manager:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·F5
  • cpe:2.3:a:f5:icontrol_service_manager:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·F5
  • cpe:2.3:a:libtiff:libtiff:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.5.2:*:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.5.3:*:*:*:*:*:*:* Versions 3.5.3 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.5.4:*:*:*:*:*:*:* Versions 3.5.4 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.5.5:*:*:*:*:*:*:* Versions 3.5.5 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.5.7:*:*:*:*:*:*:* Versions 3.5.7 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.6.0:*:*:*:*:*:*:* Versions 3.6.0 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·libtiff
  • cpe:2.3:a:libtiff:libtiff:3.7.0:*:*:*:*:*:*:* Versions 3.7.0 Vulnerable ·libtiff
  • cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Sgi
  • cpe:2.3:o:conectiva:linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Conectiva
  • cpe:2.3:o:conectiva:linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Conectiva
  • cpe:2.3:a:avaya:mn100:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Avaya
  • cpe:2.3:o:apple:mac_os_x:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.1:*:*:*:*:*:*:* Versions 10.3.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.2:*:*:*:*:*:*:* Versions 10.3.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.3:*:*:*:*:*:*:* Versions 10.3.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.4:*:*:*:*:*:*:* Versions 10.3.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.5:*:*:*:*:*:*:* Versions 10.3.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.6:*:*:*:*:*:*:* Versions 10.3.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.7:*:*:*:*:*:*:* Versions 10.3.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.8:*:*:*:*:*:*:* Versions 10.3.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:* Versions 10.3.9 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.1:*:*:*:*:*:*:* Versions 10.3.1 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.2:*:*:*:*:*:*:* Versions 10.3.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.3:*:*:*:*:*:*:* Versions 10.3.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.4:*:*:*:*:*:*:* Versions 10.3.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.5:*:*:*:*:*:*:* Versions 10.3.5 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.6:*:*:*:*:*:*:* Versions 10.3.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.7:*:*:*:*:*:*:* Versions 10.3.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.8:*:*:*:*:*:*:* Versions 10.3.8 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.3.9:*:*:*:*:*:*:* Versions 10.3.9 Vulnerable ·Apple
  • cpe:2.3:o:avaya:modular_messaging_message_storage_server:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Avaya
  • cpe:2.3:o:avaya:modular_messaging_message_storage_server:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Avaya
  • cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·gentoo
  • cpe:2.3:o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:10.0:*:amd64:*:*:*:*:* Versions 10.0 Vulnerable ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:*:x86_64:*:*:*:*:* Versions 10.1 Vulnerable ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:x86_64:*:*:*:*:* Versions 3.0 Vulnerable ·Mandrakesoft
  • cpe:2.3:o:sco:unixware:7.1.4:*:*:*:*:*:*:* Versions 7.1.4 Vulnerable ·Sco
  • cpe:2.3:o:sun:solaris:7.0:*:x86:*:*:*:*:* Versions 7.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:8.0:*:x86:*:*:*:*:* Versions 8.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:* Versions 9.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:* Versions 9.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:9.0:x86_update_2:*:*:*:*:*:* Versions 9.0 x86_update_2 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:* Versions 10.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:solaris:10.0:*:x86:*:*:*:*:* Versions 10.0 Vulnerable ·Sun
  • cpe:2.3:o:sun:sunos:5.7:*:*:*:*:*:*:* Versions 5.7 Vulnerable ·Sun
  • cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Sun

Remediation

Red Hat 2 advisories

  • RHSA-2005:021 Released 2005-04-12 · Red Hat rating Moderate
    kdegraphics security update
    • Red Hat Desktop version 3 kdegraphics-7:3.1.3-3.7, kdegraphics-7:3.1.3-3.7.i386, kdegraphics-devel-7:3.1.3-3.7 +1
    • Red Hat Enterprise Linux AS version 3 kdegraphics-7:3.1.3-3.7, kdegraphics-7:3.1.3-3.7.i386, kdegraphics-7:3.1.3-3.7.ia64 +5
    • Red Hat Enterprise Linux ES version 3 kdegraphics-7:3.1.3-3.7, kdegraphics-7:3.1.3-3.7.i386, kdegraphics-7:3.1.3-3.7.ia64 +3
    • Red Hat Enterprise Linux WS version 3 kdegraphics-7:3.1.3-3.7, kdegraphics-7:3.1.3-3.7.i386, kdegraphics-7:3.1.3-3.7.ia64 +3
  • RHSA-2004:577 Released 2004-10-22 · Red Hat rating Important
    libtiff security update
    • Red Hat Desktop version 3 libtiff-3.5.7-20.1, libtiff-3.5.7-20.1.i386, libtiff-devel-3.5.7-20.1 +1
    • Red Hat Enterprise Linux AS version 3 libtiff-3.5.7-20.1, libtiff-3.5.7-20.1.i386, libtiff-3.5.7-20.1.ia64 +5
    • Red Hat Enterprise Linux ES version 3 libtiff-3.5.7-20.1, libtiff-3.5.7-20.1.i386, libtiff-3.5.7-20.1.ia64 +3
    • Red Hat Enterprise Linux WS version 3 libtiff-3.5.7-20.1, libtiff-3.5.7-20.1.i386, libtiff-3.5.7-20.1.ia64 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2004:577, RHSA-2005:021
Red Hat Enterprise Linux AS version 3Fixed RHSA-2004:577, RHSA-2005:021
Red Hat Enterprise Linux ES version 3Fixed RHSA-2004:577, RHSA-2005:021
Red Hat Enterprise Linux WS version 3Fixed RHSA-2004:577, RHSA-2005:021

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-1307
  2. 2026-10-03 Alias added: GHSA-j2r4-vwhq-m2gg

References

Patch 3

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences