CVE:CVE-2004-0803
CNNVD:CNNVD-200412-097
libtiff是负责对TIFF图象格式编码/解码的应用库。kfax是一款小型的显示FAX文件工具，使用到libtiff库。
libtiff在处理传真文件时存在问题，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以用户进程权限执行任意指令。
kfax调用libtiff库处理.g3文件，攻击者可以构建畸形.g3文件，诱使用户处理，可导致发生缓冲区溢出，精心构建文件数据可能以用户进程权限执行任意指令。
solution:Upgrade libtiff libtiff to a higher version than 3.4,3.5.1,3.5.2,3.5.3,3.5.4,3.5.5,3.5.7,3.6.0,3.6.1,and avoid the version 3.4,3.5.1,3.5.2,3.5.3,3.5.4,3.5.5,3.5.7,3.6.0,3.6.1; Upgrade pdflib pdf_library to a higher version than 5.0.2,and avoid the version 5.0.2; Upgrade wxgtk2 wxgtk2 to a higher version than 2.5_.0,and avoid the version 2.5_.0; Upgrade apple mac_os_x to a higher version than 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6,10.2.7,10.2.8,10.3,10.3.1,10.3.2,10.3.3,10.3.4,10.3.5,10.3.6,and avoid the version 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6,10.2.7,10.2.8,10.3,10.3.1,10.3.2,10.3.3,10.3.4,10.3.5,10.3.6; Upgrade apple mac_os_x_server to a higher version than 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6,10.2.7,10.2.8,10.3,10.3.1,10.3.2,10.3.3,10.3.4,10.3.5,10.3.6,and avoid the version 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6,10.2.7,10.2.8,10.3,10.3.1,10.3.2,10.3.3,10.3.4,10.3.5,10.3.6; Upgrade kde kde to a higher version than 3.2,3.2.1,3.2.2,3.2.3,3.3,3.3.1,and avoid the version 3.2,3.2.1,3.2.2,3.2.3,3.3,3.3.1; Upgrade mandrakesoft mandrake_linux to a higher version than 10.0,and avoid the version 10.0; Upgrade redhat enterprise_linux to a higher version than 2.1,3.0,and avoid the version 2.1,3.0; Upgrade redhat enterprise_linux_desktop to a higher version than 3.0,and avoid the version 3.0; Upgrade redhat fedora_core to a higher version than core_2.0,and avoid the version core_2.0; Upgrade redhat linux_advanced_workstation to a higher version than 2.1,and avoid the version 2.1; Upgrade suse suse_linux to a higher version than 1.0,8,8.1,8.2,9.0,9.1,and avoid the version 1.0,8,8.1,8.2,9.0,9.1; Upgrade trustix secure_linux to a higher version than 1.5,2.0,2.1,and avoid the version 1.5,2.0,2.1