CVE-2017-9473

Reference Links

• https://blogs.gentoo.org/ago/2017/05/24/ytnef-memory-allocation-failure-in-tneffillmapi-ytnef-c/
• https://usn.ubuntu.com/3667-1/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ/
• https://launchpad.net/bugs/cve/CVE-2017-9473
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ/
• https://github.com/Yeraze/ytnef/issues/42
• https://security-tracker.debian.org/tracker/CVE-2017-9473
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9473
• https://ubuntu.com/security/notices/USN-3667-1
• https://nvd.nist.gov/vuln/detail/CVE-2017-9473
• https://github.com/Yeraze/ytnef/pull/57/commits/a37e92d1ba996c3d4748a04a691c6bddb8b5e129
• https://ubuntu.com/security/CVE-2017-9473

Parent vulnerabilities

(Appears in the following advisories)

• USN-3667-1

Frequently Asked Questions

• What is the severity of CVE-2017-9473?

  CVE-2017-9473 has a severity rating of moderate due to its potential to cause a denial of service through memory consumption.

• How do I fix CVE-2017-9473?

  To fix CVE-2017-9473, upgrade to versions 1.9.3-1 or later for Debian and Ubuntu as specified in the software repository.

• What is the impact of CVE-2017-9473?

  The impact of CVE-2017-9473 is a denial of service that can occur when processing crafted files, leading to excessive memory usage.

• Which software is affected by CVE-2017-9473?

  CVE-2017-9473 affects ytnef version 1.9.2 and lower across different operating systems and package managers.

• Can I use older versions of libytnef after CVE-2017-9473?

  No, it is not safe to use older versions of libytnef, specifically anything before version 1.9.3, due to the vulnerability in CVE-2017-9473.