CVE-2017-6307
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src...
CVE-2017-6307 is a high vulnerability (CVSS 7.8) in Tnef Project Tnef, published February 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 73rd percentile. Fixed in tnef 1.4.12-1.1.
- Severity
- 7.8 HighCVSS 3.0, NVD
- Exploit chance
- 1.41%EPSS, 73rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.4.12-1.1tnef +7 more
Description
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tnefDebian:12 | before 1.4.12-1.1 | 1.4.12-1.1 |
tnefDebian:13 | before 1.4.12-1.1 | 1.4.12-1.1 |
tnefDebian:14 | before 1.4.12-1.1 | 1.4.12-1.1 |
tnefDebian:7 From an advisory covering 4 CVEs | before 1.4.9-1+deb7u1, plus listed versions 1.4.9-1 | 1.4.9-1+deb7u1 |
tnefDebian:8 From an advisory covering 4 CVEs | before 1.4.9-1+deb8u1, plus listed versions 1.4.9-1 | 1.4.9-1+deb8u1 |
tnefMageia:5 From an advisory covering 4 CVEs | before 1.4.9-4.1.mga5 | 1.4.9-4.1.mga5 |
tnefUbuntu:14.04:LTS | before 1.4.9-1+deb8u2build0.14.04.1, plus listed versions 1.4.9-1 | 1.4.9-1+deb8u2build0.14.04.1 |
tnefUbuntu:16.04:LTS | before 1.4.9-1+deb8u2build0.16.04.1, plus listed versions 1.4.9-1 | 1.4.9-1+deb8u2build0.16.04.1 |
What each source reports
NVD Score used
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
- Record
CVE-2017-6307- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
- Record
CVE-2017-6307- Updated
- 2026-11-02
EUVDEUVD-2017-15368No score
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
- Record
EUVD-2017-15368- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p3gc-pjgj-g65j
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src...
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
- Record
GHSA-p3gc-pjgj-g65j- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
- Record
CVE-2017-6307- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6307
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
- Record
DEBIAN-CVE-2017-6307- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6307
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
- Record
UBUNTU-CVE-2017-6307- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0083No score
Updated tnef packages fix security vulnerability
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker. (CVE-2017-6307)
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation. (CVE-2017-6308)
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker. (CVE-2017-6309)
An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker. (CVE-2017-6310)
- Record
MGASA-2017-0083- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/verdammelt/tnef/blob/master/ChangeLog
securityfocus.com/bid/96427
x41-dsec.de/lab/advisories/x41-2017-004-tnef
debian.org/security/2017/dsa-3798
security.gentoo.org/glsa/201708-02
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-6307
security-tracker.debian.org/tracker/CVE-2017-6307
advisories.mageia.org/MGASA-2017-0083.html
bugs.mageia.org/show_bug.cgi?id=20343
openwall.com/lists/oss-security/2017/02/23/17
ubuntu.com/security/CVE-2017-6307
cve.org/CVERecord?id=CVE-2017-6307