VulnerabilityModified
CVE-2004-0803
Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files.
HIGH 7.5EPSS 8.27%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple vulnerabilities in the RLE (run length encoding) decoders for libtiff 3.6.1 and earlier, related to buffer overflows and integer overflows, allow remote attackers to execute arbitrary code via TIFF files.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 8.27% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- libtiff/libtiff · pdflib/pdf library · wxgtk2/wxgtk2 · apple/mac os x · apple/mac os x server · kde/kde · mandrakesoft/mandrake linux · redhat/enterprise linux · redhat/enterprise linux desktop · redhat/fedora core · redhat/linux advanced workstation · suse/suse linux · trustix/secure linux
- Source
- cve@mitre.org
References
- http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000888
- http://marc.info/?l=bugtraq&m=109778785107450&w=2
- http://scary.beasts.org/security/CESA-2004-006.txt
- http://secunia.com/advisories/12818
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
- http://www.debian.org/security/2004/dsa-567Patch, Vendor Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200410-11.xml
- http://www.kb.cert.org/vuls/id/948752Third Party Advisory, US Government Resource
- http://www.kde.org/info/security/advisory-20041209-2.txt
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:109
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:052
- http://www.novell.com/linux/security/advisories/2004_38_libtiff.html
- http://www.redhat.com/support/errata/RHSA-2004-577.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-021.html
- http://www.redhat.com/support/errata/RHSA-2005-354.html
- http://www.securityfocus.com/bid/11406
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17703
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100114
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8896
- http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000888
- http://marc.info/?l=bugtraq&m=109778785107450&w=2
- http://scary.beasts.org/security/CESA-2004-006.txt
- http://secunia.com/advisories/12818
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
- http://www.debian.org/security/2004/dsa-567Patch, Vendor Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200410-11.xml
- http://www.kb.cert.org/vuls/id/948752Third Party Advisory, US Government Resource
- http://www.kde.org/info/security/advisory-20041209-2.txt
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.