CVE-2017-6308: Integer Overflow

Q: What does an attacker need in order to exploit this issue?

The CVSS vector indicates local attack access and user interaction are required. No privileges are required, but exploitation depends on a user interacting with malicious input.

Q: Which installations are affected?

The issue affects tnef versions before 1.4.13. The listed affected software includes Tnef Project Tnef and Debian Debian Linux.

Q: What is the impact if exploitation succeeds?

The identified integer overflows can lead to heap overflows in memory-allocation wrapper functions. The CVSS vector rates confidentiality, integrity, and availability impact as high.

Q: What should teams do if they use an affected version?

Apply the available patch and upgrade tnef to a version that is not before 1.4.13. The provided Debian security advisory may contain distribution-specific remediation information.

Published Feb 24, 2017

Updated

An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.

Affected Software

2 affected components

Tnef Project Tnef<=1.4.12

Debian Debian Linux=8.0

Remediation

Event History

Feb 24, 2017

CVE Published

via MITRE·04:23 AM

Data Sourced

via MITRE·04:23 AM

Description

Data Sourced

via NVD·04:59 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need in order to exploit this issue?

The CVSS vector indicates local attack access and user interaction are required. No privileges are required, but exploitation depends on a user interacting with malicious input.

Which installations are affected?

The issue affects tnef versions before 1.4.13. The listed affected software includes Tnef Project Tnef and Debian Debian Linux.

What is the impact if exploitation succeeds?

The identified integer overflows can lead to heap overflows in memory-allocation wrapper functions. The CVSS vector rates confidentiality, integrity, and availability impact as high.

What should teams do if they use an affected version?

Apply the available patch and upgrade tnef to a version that is not before 1.4.13. The provided Debian security advisory may contain distribution-specific remediation information.

CVE-2017-6308: Integer Overflow

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What does an attacker need in order to exploit this issue?

Which installations are affected?

What is the impact if exploitation succeeds?

What should teams do if they use an affected version?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need in order to exploit this issue?

Which installations are affected?

What is the impact if exploitation succeeds?

What should teams do if they use an affected version?