High 7.5Published Dec 21, 2004

CVE-2004-1307Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number…

Updated under an hour ago (Nov 2, 2026, 12:10 AM ET)

Does this affect you?

It affects avaya call_management_system_server and 18 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for avaya call_management_system_server Exploited in the last 30 days

Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.

CVSS: 7.5 HIGH (v2.0, NVD)AV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

avaya call_management_system_server avaya:call_management_system_server	8.0; 9.0; 11.0; 12.0; 13.0	NVD
avaya cvlan avaya:cvlan	all versions	NVD
avaya integrated_management avaya:integrated_management	all versions	NVD
avaya interactive_response avaya:interactive_response	all versions; 1.2.1; 1.3	NVD
avaya intuity_audix_lx avaya:intuity_audix_lx	all versions	NVD
f5 icontrol_service_manager f5:icontrol_service_manager	1.3; 1.3.4; 1.3.5; 1.3.6	NVD
libtiff libtiff libtiff:libtiff	3.4; 3.5.1; 3.5.2; 3.5.3; 3.5.4; 3.5.5; 3.5.7; 3.6.0; and 2 more ranges	NVD
sgi propack sgi:propack	3.0	NVD
conectiva linux conectiva:linux	9.0; 10.0	NVD
avaya mn100 avaya:mn100	all versions	NVD
1–10 of 19

References

References

http://lists.apple.com/archives/security-announce/2005/May/msg00001.html	patch, vendor-advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities&flashstatus=true	patch, vendor-advisory
http://www.kb.cert.org/vuls/id/539110	patch, third-party-advisory, us-government-resource
http://www.us-cert.gov/cas/techalerts/TA05-136A.html	us-government-resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11175

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.