tnef vulnerabilities

An issue was discovered in tnef before 1.4.13 related to four type confusions in the file_add_mapi_attrs() function. This may lead to invalid read and write operations controlled by an attacker.

An issue was discovered in tnef before version 1.4.13 related to two type confusions in the parse_file() function. This may lead to invalid read and write operations controlled by an attacker.

An issue was discovered in tnef before version 1.4.13 related to integer overflows that can lead to heap overflows in functions handling memory allocation.

An issue was discovered in tnef before version 1.4.13 related to two OOB Write operations in the mapi_attr_read() function. These may lead to invalid read and write operations controlled by an attacker.

An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.

A heap-based buffer overflow exists in the tnef library's find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted TNEF file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer.

A flaw was found in the tnef library involving improper memory management when processing specially crafted TNEF files with multiple message bodies. This leads to use-after-free and double-free conditions, causing the application to crash and resulting in a Denial of Service (DoS).

A flaw was found in the tnef library due to improper validation of input buffer boundaries before copying data in get_rtf_data_from_buf(). A specially crafted file with uncompressed RTF data can cause reading beyond allocated memory, leading to a crash (DoS) or leaking sensitive memory contents into extracted output files.