CVE-2017-8911: Integer Underflow

Published May 12, 2017

Updated

An integer underflow has been identified in the unicodetoutf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.

Affected Software

1 affected component

Tnef Project Tnef=1.4.14

Remediation

Patch Available

https://github.com/verdammelt/tnef/issues/23

Event History

May 12, 2017

CVE Published

via MITRE·06:54 AM

Data Sourced

via MITRE·06:54 AM

Description

Frequently Asked Questions

What would an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction, according to the CVSS vector. An attacker would need to cause the affected tnef component to process crafted input that reaches unicode_to_utf8().

What is the potential impact if exploitation succeeds?

The integer underflow may cause attacker-controlled invalid write operations. The reported CVSS metrics indicate potential high impact to confidentiality, integrity, and availability.

What should teams do to remediate the issue?

Apply the available patch for Tnef Project Tnef. The affected version identified in the report is tnef 1.4.14.

CVE-2017-8911: Integer Underflow

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

What would an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

What would an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

What should teams do to remediate the issue?