CVE-2004-0804

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-11-03 · updated 2026-06-16
Weakness: CWE-369

Description

Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452.

Affected products

libtiff: before 3.7.0 — fixed in 3.7.0

How to fix

Upgrade to a fixed version: libtiff 3.7.0. Check the vendor advisory for mitigations.

References

http://bugzilla.remotesensing.org/show_bug.cgi?id=111
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000888
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
http://www.debian.org/security/2004/dsa-567
http://www.kb.cert.org/vuls/id/555304
http://www.kde.org/info/security/advisory-20041209-2.txt
http://www.mandriva.com/security/advisories?name=MDKSA-2004:109
http://www.mandriva.com/security/advisories?name=MDKSA-2005:052
http://www.novell.com/linux/security/advisories/2004_38_libtiff.html
http://www.redhat.com/support/errata/RHSA-2004-577.html
http://www.redhat.com/support/errata/RHSA-2005-021.html

Get alerted when CVE-2004-0804 or the next vulnerability affects your stack