CVE-2017-9146

High

Published: 22/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The TNEFFillMapi function in lib/ytnef.c in libytnef through version 1.9.2 does not ensure a nonzero count value before a certain memory allocation, allowing remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.

Risk Assessment

Attackers can exploit this vulnerability to remotely trigger application crashes, potentially leading to service downtime. There is also a risk of unspecified impact on the system.

Recommendation

It is recommended to update libytnef to the latest version to mitigate this vulnerability. Additionally, monitor and analyze tnef files being processed by the system.

Other vulnerabilities in libytnef

CVE-2017-9058Critical
In libytnef in versions up to 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.

Original NVD description (English source)

The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.