CVE-2017-6303
HighSummary
An issue was discovered in ytnef before version 1.9.1 related to invalid write and integer overflow, which may lead to unauthorized access or data corruption.
Risk Assessment
Organizations using the vulnerable version of ytnef may be exposed to attacks that could result in data integrity loss or unauthorized access.
Recommendation
It is recommended to update ytnef to version 1.9.1 or later to mitigate this vulnerability.
Other vulnerabilities in ytnef
See all- CVE-2017-6802High
An issue was discovered in ytnef before 1.9.2 related to a potential heap-based buffer over-read on incoming Compressed RTF Streams, concerning the DecompressRTF() function in libytnef.
- CVE-2017-6801High
An issue was discovered in ytnef before version 1.9.2, which may lead to out-of-bounds access due to fields of Size 0 in TNEFParse() in libytnef.
- CVE-2017-6800High
An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
- CVE-2017-6306High
An issue was discovered in ytnef before version 1.9.1 related to directory traversal using the filename, associated with the SanitizeFilename function in settings.c.
- CVE-2017-6305High
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '8 of 9. Out of Bounds read and write.'
- CVE-2017-6304High
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '7 of 9. Out of Bounds read.'
- CVE-2017-6302High
An issue was discovered in ytnef before version 1.9.1 related to an integer overflow, described as '5 of 9'.
- CVE-2017-6301High
An issue was discovered in ytnef before version 1.9.1 related to out of bounds reads.
- CVE-2017-6300High
An issue was discovered in ytnef before 1.9.1 related to a buffer overflow in the version field in lib/tnef-types.h.
- CVE-2017-6298High
An issue was discovered in ytnef before version 1.9.1 related to null pointer dereference and unchecked return value from calloc.
Original NVD description (English source)
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "6 of 9. Invalid Write and Integer Overflow."