An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.

Update to 1.4.15. Fixes CVE-2017-8911

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201708-02 (TNEF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in TNEF. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       MIME attachment of type &ldquo;application/ms-tnef&rdquo; using TNEF, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Release 1.4.14 includes security bug fixes introduced in 1.4.13 and a further bug fix.

The tnef-dolphin file manager integration is updated to suit the kf5/qt5 base.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eric Sesterhenn, from X41 D-Sec GmbH, discovered several vulnerabilities in tnef, a tool used to unpack MIME attachments of type 'application/ms-tnef'. Multiple heap overflows, type confusions and out of bound reads and writes could be exploited by tricking a user into opening a malicious attachment. This would result in denial of service via application crash, or potential arbitrary code execution.

While fixing the above mentioned CVEs, upstream introduced a regression. The new patches added for this upload take care of that.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.9-1+deb7u2.

We recommend that you upgrade your tnef packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
105919	Fedora 27 : tnef (2017-8489b17872)	Nessus	Fedora Local Security Checks	critical
104159	Fedora 26 : tnef (2017-c2882ae75b)	Nessus	Fedora Local Security Checks	critical
104149	Fedora 25 : tnef (2017-2b28a055f2)	Nessus	Fedora Local Security Checks	critical
102532	GLSA-201708-02 : TNEF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
101701	Fedora 26 : tnef (2017-ab43d1d240)	Nessus	Fedora Local Security Checks	high
100032	Fedora 25 : tnef (2017-cc029be02d)	Nessus	Fedora Local Security Checks	high
100030	Fedora 24 : tnef (2017-7de130a80d)	Nessus	Fedora Local Security Checks	high
97474	Debian DSA-3798-1 : tnef - security update	Nessus	Debian Local Security Checks	high
97418	Debian DLA-839-2 : tnef regression update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-6307

high

Tenable Plugins

critical

critical

critical

critical

high

high

high

high

high