CVE-2004-1307: apple mac_os_x
Vulnerability summary
CVE-2004-1307 is a high (CVSS 7.5) vulnerability in apple mac_os_x. EPSS estimates a 6.34% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 04-05-2005PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.34%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.34% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Avaya3 products
- call_management_system_server8.0 | 9.0 | 11.0 | 12.0 | 13.0
- interactive_response1.2.1 | 1.3
- modular_messaging_message_storage_server1.1 | 2.0
Apple2 products
- mac_os_x10.3 | 10.3.1 | 10.3.2 | 10.3.3 | 10.3.4 | 10.3.5 | 10.3.6 | 10.3.7 | 10.3.8 | 10.3.9
- mac_os_x_server10.3 | 10.3.1 | 10.3.2 | 10.3.3 | 10.3.4 | 10.3.5 | 10.3.6 | 10.3.7 | 10.3.8 | 10.3.9
Mandrakesoft2 products
- mandrake_linux10.0 | 10.1
- mandrake_linux_corporate_server3.0
Conectiva1 product
- linux9.0 | 10.0
Debian1 product
- tiff< 3.7.0
F51 product
- icontrol_service_manager1.3 | 1.3.4 | 1.3.5 | 1.3.6
Libtiff1 product
- libtiff3.4 | 3.5.1 | 3.5.2 | 3.5.3 | 3.5.4 | 3.5.5 | 3.5.7 | 3.6.0 | 3.6.1 | 3.7.0
Sco1 product
- unixware7.1.4
Sgi1 product
- propack3.0
10 vendors · 15 products
References
8 links- www.us-cert.gov/cas/techalerts/TA05-136A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
- www.idefense.com/application/poi/display?id=173&type=vulnerabilities&flashstatus=trueThird Party AdvisoryX Refsource IDEFENSEPatchVendor Advisory
- lists.apple.com/archives/security-announce/2005/May/msg00001.htmlVendor AdvisoryX Refsource APPLEPatch
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11175VDB EntrySignatureX Refsource OVAL
