REDHAT-BUG-2544477: Use After Free
A flaw was found in tnef. When a TNEF stream contains more than one MAPI RTF or HTML body value, getbodyfiles() allocates a single filename buffer and a single MIME-type buffer and assigns the same pointers to every generated output file, instead of a separate copy per file. Each of these files is later freed independently, producing a use-after-free followed by a double-free on the second and subsequent files. The issue was confirmed under AddressSanitizer and crashes the process when extracting a crafted TNEF stream with multiple body values; no code-execution primitive has been demonstrated.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the crash?
An attacker would need to supply a crafted TNEF stream containing more than one MAPI RTF or HTML body value and have it processed for extraction.
What is the observed impact?
The flaw causes a use-after-free followed by a double-free when the generated body files are freed independently. It has been confirmed to crash the process under AddressSanitizer; no code-execution primitive has been demonstrated.