Release 1.4.14 includes security bug fixes introduced in 1.4.13 and a further bug fix.

The tnef-dolphin file manager integration is updated to suit the kf5/qt5 base.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.4.15. Fixes CVE-2017-8911

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201708-02 (TNEF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in TNEF. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       MIME attachment of type &ldquo;application/ms-tnef&rdquo; using TNEF, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

While fixing the above mentioned CVEs, upstream introduced a regression. The new patches added for this upload take care of that.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.9-1+deb7u2.

We recommend that you upgrade your tnef packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eric Sesterhenn, from X41 D-Sec GmbH, discovered several vulnerabilities in tnef, a tool used to unpack MIME attachments of type 'application/ms-tnef'. Multiple heap overflows, type confusions and out of bound reads and writes could be exploited by tricking a user into opening a malicious attachment. This would result in denial of service via application crash, or potential arbitrary code execution.

ID	Name	Product	Family	Published	Updated	Severity
101701	Fedora 26 : tnef (2017-ab43d1d240)	Nessus	Fedora Local Security Checks	7/17/2017	12/10/2025	high
105919	Fedora 27 : tnef (2017-8489b17872)	Nessus	Fedora Local Security Checks	1/15/2018	11/4/2025	critical
100030	Fedora 24 : tnef (2017-7de130a80d)	Nessus	Fedora Local Security Checks	5/9/2017	12/19/2025	high
100032	Fedora 25 : tnef (2017-cc029be02d)	Nessus	Fedora Local Security Checks	5/9/2017	12/19/2025	high
102532	GLSA-201708-02 : TNEF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/17/2017	11/26/2025	critical
97418	Debian DLA-839-2 : tnef regression update	Nessus	Debian Local Security Checks	2/28/2017	12/31/2025	high
97474	Debian DSA-3798-1 : tnef - security update	Nessus	Debian Local Security Checks	3/2/2017	12/31/2025	high
104149	Fedora 25 : tnef (2017-2b28a055f2)	Nessus	Fedora Local Security Checks	10/26/2017	11/17/2025	critical
104159	Fedora 26 : tnef (2017-c2882ae75b)	Nessus	Fedora Local Security Checks	10/26/2017	11/17/2025	critical

Detections

Analytics

Plugins Search

high

critical

high

high

critical

high

high

critical

critical