CVE-2010-5109: Buffer Overflow
Created attachment 591258 [details] proposed patch to fix possible buffer overflows.
Description of problem: compiler warning: call ... will always overflow destination buffer. indeed, there is a trivial bug in the code, no space is reserved for trailing \0. patch to fix: --- libytnef-1.5/ytnef.c 2004-08-26 17:09:05.000000000 +0000 +++ libytnef-1.5/ytnef.c 2012-06-08 19:34:07.826123387 +0000 @@ -1327,7 +1327,7 @@ ULONG compressedSize, uncompressedSize, magic, crc32; compPrebuf.size = strlen(RTFPREBUF); - compPrebuf.data = calloc(compPrebuf.size, 1); + compPrebuf.data = calloc(compPrebuf.size+1, 1); strcpy(compPrebuf.data, RTFPREBUF); src = p->data;
Version-Release number of selected component (if applicable): libytnef-1.5-7.fc17
Other sources
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a crafted TNEF file, which triggers a buffer overflow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-5109?
CVE-2010-5109 is a vulnerability that has been categorized with a medium severity rating due to potential buffer overflows.
How do I fix CVE-2010-5109?
To fix CVE-2010-5109, it is recommended to apply the proposed patch provided in the associated bug report.
Which software is affected by CVE-2010-5109?
CVE-2010-5109 affects Randall Hand's Yerase's Tnef Stream Reader as well as Fedora versions 16 and 17.
What types of vulnerabilities does CVE-2010-5109 involve?
CVE-2010-5109 involves buffer overflow vulnerabilities that could be exploited in certain software.
Is there a public discussion regarding CVE-2010-5109?
Yes, there have been public discussions about CVE-2010-5109 in security mailing lists and bug tracking systems.