Security Information / 2017 / Security Information -- DSA-3869-1 tnef

Debian Security Advisory

DSA-3869-1 tnef -- security update

Date Reported:

01 Jun 2017

Affected Packages:

tnef

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 862442.
In Mitre's CVE dictionary: CVE-2017-8911.

More information:

It was discovered that tnef, a tool used to unpack MIME attachments of type "application/ms-tnef", did not correctly validate its input. An attacker could exploit this by tricking a user into opening a malicious attachment, which would result in a denial-of-service by application crash.

For the stable distribution (jessie), this problem has been fixed in version 1.4.9-1+deb8u3.

For the unstable distribution (sid), this problem has been fixed in version 1.4.12-1.2.

We recommend that you upgrade your tnef packages.