CVE-2017-6308

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3798Third Party Advisory
http://www.securityfocus.com/bid/96427Third Party Advisory, VDB Entry
https://github.com/verdammelt/tnef/blob/master/ChangeLogPatch, Release Notes, Third Party Advisory
https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201708-02Third Party Advisory
https://www.x41-dsec.de/lab/advisories/x41-2017-004-tnef/Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3798Third Party Advisory
http://www.securityfocus.com/bid/96427Third Party Advisory, VDB Entry
https://github.com/verdammelt/tnef/blob/master/ChangeLogPatch, Release Notes, Third Party Advisory
https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201708-02Third Party Advisory
https://www.x41-dsec.de/lab/advisories/x41-2017-004-tnef/Patch, Third Party Advisory

Timeline

Published: Feb 24, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-63097.8An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to in CVE-2017-63107.8An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might CVE-2017-63117.5gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and applica CVE-2017-63125.5Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and applicati CVE-2017-63137.1Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service CVE-2017-63145.5The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite lo CVE-2017-63159.8Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx.CVE-2017-63169.8Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID CVE-2017-63176.5Memory leak in the add_shader_program function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a deni CVE-2017-63187.5saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.CVE-2017-63197.8The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer over CVE-2017-63208.8A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1