CVE-2017-8911

EUVD-2017-17851
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.
Wrap or Wraparound
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Affected Products (NVD)
VendorProductVersion
tnef_projecttnef
1.4.14
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tnef
bookworm
1.4.18-3
fixed
bullseye
1.4.18-3
fixed
sid
1.4.18-4
fixed
trixie
1.4.18-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tnef
trusty
Fixed 1.4.9-1+deb8u3build0.14.04.1
released
xenial
Fixed 1.4.9-1+deb8u3build0.16.04.1
released
yakkety
Fixed 1.4.9-1+deb8u3build0.16.10.1
released
zesty
Fixed 1.4.12-1ubuntu0.1
released
Common Weakness Enumeration
References
http://www.debian.org/security/2017/dsa-3869
https://github.com/verdammelt/tnef/issues/23
https://security.gentoo.org/glsa/201708-02
http://www.debian.org/security/2017/dsa-3869
https://github.com/verdammelt/tnef/issues/23
https://security.gentoo.org/glsa/201708-02