CVE-2017-8911

NameCVE-2017-8911
DescriptionAn integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-962-1, DSA-3869-1
NVD severityhigh (attack range: remote)
Debian Bugs862442

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tnef (PTS)wheezy1.4.9-1vulnerable
wheezy (security)1.4.9-1+deb7u3fixed
jessie (security), jessie1.4.9-1+deb8u3fixed
buster, sid, stretch1.4.12-1.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tnefsource(unstable)1.4.12-1.2high862442
tnefsourcejessie1.4.9-1+deb8u3highDSA-3869-1
tnefsourcewheezy1.4.9-1+deb7u3highDLA-962-1

Notes

https://github.com/verdammelt/tnef/issues/23
Fixed by: https://github.com/verdammelt/tnef/commit/a686971a1f124d9ae18946b1844dbc2c1f30df10

Search for package or bug name: Reporting problems