CVE-2017-6309
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the...
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
7.8
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
- Record
CVE-2017-6309- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
- Record
CVE-2017-6309- Updated
- 2026-11-02
EUVDEUVD-2017-15370 No score
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
- Record
EUVD-2017-15370- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-69j8-qm33-j976
7.8
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the...
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
- Record
GHSA-69j8-qm33-j976- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
7.8
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
- Record
CVE-2017-6309- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6309
7.8
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
- Record
DEBIAN-CVE-2017-6309- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6309
7.8
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
- Record
UBUNTU-CVE-2017-6309- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0083 No score
Updated tnef packages fix security vulnerability
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker. (CVE-2017-6307)
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation. (CVE-2017-6308)
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker. (CVE-2017-6309)
An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker. (CVE-2017-6310)
- Record
MGASA-2017-0083- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tnefDebian:12 |
before 1.4.12-1.1 | 1.4.12-1.1 |
tnefDebian:13 |
before 1.4.12-1.1 | 1.4.12-1.1 |
tnefDebian:14 |
before 1.4.12-1.1 | 1.4.12-1.1 |
tnefDebian:7 From an advisory covering 4 CVEs |
before 1.4.9-1+deb7u1, plus listed versions 1.4.9-1 |
1.4.9-1+deb7u1 |
tnefDebian:8 From an advisory covering 4 CVEs |
before 1.4.9-1+deb8u1, plus listed versions 1.4.9-1 |
1.4.9-1+deb8u1 |
tnefMageia:5 From an advisory covering 4 CVEs |
before 1.4.9-4.1.mga5 | 1.4.9-4.1.mga5 |
tnefUbuntu:14.04:LTS |
before 1.4.9-1+deb8u2build0.14.04.1, plus listed versions 1.4.9-1 |
1.4.9-1+deb8u2build0.14.04.1 |
tnefUbuntu:16.04:LTS |
before 1.4.9-1+deb8u2build0.16.04.1, plus listed versions 1.4.9-1 |
1.4.9-1+deb8u2build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6309 is a high vulnerability (CVSS 7.8) in Tnef Project Tnef, published February 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in tnef 1.4.12-1.1.
References
github.com/verdammelt/tnef/blob/master/ChangeLog
securityfocus.com/bid/96427
x41-dsec.de/lab/advisories/x41-2017-004-tnef
debian.org/security/2017/dsa-3798
security.gentoo.org/glsa/201708-02
github.com/verdammelt/tnef/commit/8dccf79857ceeb7a6d3e42c1e762e7b865d5344d
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-6309
github.com/advisories/GHSA-69j8-qm33-j976
security-tracker.debian.org/tracker/CVE-2017-6309
advisories.mageia.org/MGASA-2017-0083.html
bugs.mageia.org/show_bug.cgi?id=20343
openwall.com/lists/oss-security/2017/02/23/17
ubuntu.com/security/CVE-2017-6309
cve.org/CVERecord?id=CVE-2017-6309