CVE-2017-8911

NameCVE-2017-8911
DescriptionAn integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-962-1, DSA-3869-1
Debian Bugs862442

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tnef (PTS)bookworm, bullseye1.4.18-3fixed
trixie1.4.18-4fixed
forky, sid1.4.18-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tnefsourcewheezy1.4.9-1+deb7u3DLA-962-1
tnefsourcejessie1.4.9-1+deb8u3DSA-3869-1
tnefsource(unstable)1.4.12-1.2862442

Notes

https://github.com/verdammelt/tnef/issues/23
Fixed by: https://github.com/verdammelt/tnef/commit/a686971a1f124d9ae18946b1844dbc2c1f30df10
Search for package or bug name: Reporting problems