CVE catalog

CVE-2017-6308

tnef: CVE-2017-6308

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.54% · Oct 27, 2026

An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantnefsid1.4.18-6fixed
Debiantnefforky1.4.18-6fixed
Debiantneftrixie1.4.18-4fixed
Debiantnefbookworm1.4.18-3fixed
Ubuntutnef14.041.4.9-1vulnerable
Ubuntutnef14.041.4.9-1+deb8u2build0.14.04.1fixed
Ubuntutnef16.041.4.9-1vulnerable
Ubuntutnef16.041.4.9-1+deb8u2build0.16.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantnefsourcesid1.4.12-1.1not yet assignedNot reported[856117]
Debiantnefsourceforky1.4.12-1.1not yet assignedNot reported[856117]
Debiantnefsourcetrixie1.4.12-1.1not yet assignedNot reported[856117]
Debiantnefsourcebookworm1.4.12-1.1not yet assignedNot reported[856117]
Ubuntutnefdeb14.041.4.9-1+deb8u2build0.14.04.1Not reportedUBUNTU-CVE-2017-6308Not reported
Ubuntutnefdeb16.041.4.9-1+deb8u2build0.16.04.1Not reportedUBUNTU-CVE-2017-6308Not reported

[Debian bug #856117]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [tnef]Fixed
    Details (2)

    • 1.4.18-3 · amd64 · bookworm

      Fixed · Fixed: 1.4.12-1.1

      dsa · tnef · debian · bookworm; dsa · tnef · debian · 12

    • 1.4.18-3 · arm64 · bookworm

      Fixed · Fixed: 1.4.12-1.1

      dsa · tnef · debian · bookworm; dsa · tnef · debian · 12

[Debian 13 (Trixie)]

  • [tnef]Fixed

    Source package: [tnef]

    Details (2)

    • 1.4.18-4 · amd64 · trixie

      Fixed · Fixed: 1.4.12-1.1

      dsa · tnef · debian · 13

    • 1.4.18-4+b1 · arm64 · trixie

      Fixed · Fixed: 1.4.12-1.1

      dsa · tnef · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]