CVE-2004-0803

Description

Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files.

Affected products

• Apple / mac_os_x10.2.5 – 10.2.5
• Apple / mac_os_x10.2.6 – 10.2.6
• Apple / mac_os_x10.2.7 – 10.2.7
• Apple / mac_os_x10.2.8 – 10.2.8
• Apple / mac_os_x10.3 – 10.3
• Apple / mac_os_x10.3.6 – 10.3.6
• Apple / mac_os_x10.3.5 – 10.3.5
• Apple / mac_os_x10.3.4 – 10.3.4
• Apple / mac_os_x10.3.3 – 10.3.3
• Apple / mac_os_x10.3.2 – 10.3.2
• Apple / mac_os_x10.3.1 – 10.3.1
• Apple / mac_os_x10.2 – 10.2
• Apple / mac_os_x10.2.1 – 10.2.1
• Apple / mac_os_x10.2.2 – 10.2.2
• Apple / mac_os_x10.2.3 – 10.2.3
• Apple / mac_os_x10.2.4 – 10.2.4
• Apple / mac_os_x_server10.3.1 – 10.3.1
• Apple / mac_os_x_server10.3.3 – 10.3.3
• Apple / mac_os_x_server10.3.4 – 10.3.4
• Apple / mac_os_x_server10.3.5 – 10.3.5
• Apple / mac_os_x_server10.3.6 – 10.3.6
• Apple / mac_os_x_server10.2.5 – 10.2.5
• Apple / mac_os_x_server10.2.6 – 10.2.6
• Apple / mac_os_x_server10.2.7 – 10.2.7
• Apple / mac_os_x_server10.2.8 – 10.2.8
• Apple / mac_os_x_server10.3 – 10.3
• Apple / mac_os_x_server10.3.2 – 10.3.2
• Apple / mac_os_x_server10.2 – 10.2
• Apple / mac_os_x_server10.2.1 – 10.2.1
• Apple / mac_os_x_server10.2.2 – 10.2.2
• Apple / mac_os_x_server10.2.3 – 10.2.3
• Apple / mac_os_x_server10.2.4 – 10.2.4
• KDE / kde3.3 – 3.3
• KDE / kde3.3.1 – 3.3.1
• KDE / kde3.2.3 – 3.2.3
• KDE / kde3.2.2 – 3.2.2
• KDE / kde3.2.1 – 3.2.1
• KDE / kde3.2 – 3.2
• libtiff / libtiff3.4 – 3.4
• libtiff / libtiff3.5.1 – 3.5.1
• libtiff / libtiff3.5.2 – 3.5.2
• libtiff / libtiff3.5.3 – 3.5.3
• libtiff / libtiff3.5.4 – 3.5.4
• libtiff / libtiff3.5.5 – 3.5.5
• libtiff / libtiff3.5.7 – 3.5.7
• libtiff / libtiff3.6.0 – 3.6.0
• libtiff / libtiff3.6.1 – 3.6.1
• mandrakesoft / mandrake_linux10.0 – 10.0
• mandrakesoft / mandrake_linux10.0 – 10.0
• pdflib / pdf_library5.0.2 – 5.0.2
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux_desktop3.0 – 3.0
• RedHat / fedora_corecore_2.0 – core_2.0
• RedHat / linux_advanced_workstation2.1 – 2.1
• RedHat / linux_advanced_workstation2.1 – 2.1
• SUSE / suse_linux9.0 – 9.0
• SUSE / suse_linux1.0 – 1.0
• SUSE / suse_linux8 – 8
• SUSE / suse_linux8.1 – 8.1
• SUSE / suse_linux8.2 – 8.2
• SUSE / suse_linux9.0 – 9.0
• SUSE / suse_linux9.1 – 9.1
• trustix / secure_linux2.1 – 2.1
• trustix / secure_linux1.5 – 1.5
• trustix / secure_linux2.0 – 2.0
• wxgtk2 / wxgtk22.5_.0 – 2.5_.0

References

• MISChttp://www.gentoo.org/security/en/glsa/glsa-200410-11.xml
• MISChttp://www.redhat.com/support/errata/RHSA-2004-577.html
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2004:109
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100114
• MISChttp://www.redhat.com/support/errata/RHSA-2005-021.html
• MAILING_LISThttp://marc.info/?l=bugtraq&m=109778785107450&w=2
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8896
• MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
• MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
• VENDOR_ADVISORYhttp://www.novell.com/linux/security/advisories/2004_38_libtiff.html
• MISChttp://scary.beasts.org/security/CESA-2004-006.txt
• MISChttp://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000888
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:052
• MISChttp://www.kde.org/info/security/advisory-20041209-2.txt
• MISChttp://www.redhat.com/support/errata/RHSA-2005-354.html
• VENDOR_ADVISORYhttp://secunia.com/advisories/12818
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/17703
• MISChttp://www.securityfocus.com/bid/11406
• VENDOR_ADVISORYhttp://www.debian.org/security/2004/dsa-567
• MISChttp://www.kb.cert.org/vuls/id/948752