{"result":"OK","data":{"documents":{"CVE-2017-6301":{"id":"CVE-2017-6301","vendorId":null,"type":"cve","bulletinFamily":"cve","title":"CVE-2017-6301","description":"An issue was discovered in ytnef before 1.9.1. This is related to a patch described as \"4 of 9. Out of Bounds Reads.\"","attachments":[],"timestamps":{"created":"2017-02-24T01:59:00Z","updated":"2026-07-26T12:49:48.652000Z","enriched":"2026-07-26T12:49:48.652000Z","reviewed":"2026-07-15T10:45:36.904000Z","webApplicabilityUpdated":null,"metricsUpdated":"2026-06-16T05:41:21.016000Z","contentUpdated":"2026-06-17T18:51:56.569000Z"},"published":"2017-02-24T04:23:00","modified":"2026-06-17T01:22:06","epss":[{"cve":"CVE-2017-6301","epss":0.01223,"percentile":0.65645,"date":"2026-07-28"}],"cvss":{"score":7.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd"},"metrics":{"nvd":{"cvss2":{"source":"nvd","version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false,"temporalScore":6.8},"cvss3":{"source":"nvd","version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}},"cvss2":{"cvssV2":{"source":"nvd","version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false,"temporalScore":6.8}},"cvss3":{"cvssV3":{"source":"nvd","version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"cvss4":{},"href":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-6301","sourceAvailable":true,"reporter":"mitre","references":["http://www.debian.org/security/2017/dsa-3846","https://www.x41-dsec.de/lab/advisories/x41-2017-002-ytnef/","http://www.openwall.com/lists/oss-security/2017/02/15/4","https://github.com/Yeraze/ytnef/pull/27","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ/","http://www.securityfocus.com/bid/96423"],"cvelist":["CVE-2017-6301"],"immutableFields":[],"lastseen":"2026-06-17T18:51:56","viewCount":172,"enchantments":{"dependencies":{"references":[{"type":"cnvd","idList":["CNVD-2017-02562"]},{"type":"cvelist","idList":["CVELIST:CVE-2017-6301"]},{"type":"debian","idList":["DEBIAN:DLA-878-1:061B4","DEBIAN:DSA-3846-1:8ED18","DEBIAN:DSA-3846-1:E40E4"]},{"type":"debiancve","idList":["DEBIANCVE:CVE-2017-6301"]},{"type":"euvd","idList":["EUVD-2017-15362"]},{"type":"mageia","idList":["MGASA-2017-0174"]},{"type":"nessus","idList":["DEBIAN_DLA-878.NASL","DEBIAN_DSA-3846.NASL","FEDORA_2019-7D7083B8BE.NASL","UBUNTU_USN-3288-1.NASL","UBUNTU_USN-4615-1.NASL"]},{"type":"nvd","idList":["NVD:CVE-2017-6301"]},{"type":"openvas","idList":["OPENVAS:1361412562310703846","OPENVAS:1361412562310843163","OPENVAS:1361412562310844692","OPENVAS:1361412562310876379","OPENVAS:1361412562310890878","OPENVAS:13614125623111020170174","OPENVAS:703846"]},{"type":"osv","idList":["OSV:DEBIAN-CVE-2017-6301","OSV:DLA-878-1","OSV:DSA-3846-1","OSV:MGASA-2017-0174","OSV:UBUNTU-CVE-2017-6301","OSV:USN-3288-1","OSV:USN-4615-1"]},{"type":"prion","idList":["PRION:CVE-2017-6301"]},{"type":"ubuntu","idList":["USN-3288-1","USN-4615-1"]},{"type":"ubuntucve","idList":["UB:CVE-2017-6301"]}]},"score":{"value":7.3,"uncertanity":0.2,"vector":"NONE"},"backreferences":{"references":[{"type":"debian","idList":["DEBIAN:DLA-878-1:061B4","DEBIAN:DSA-3846-1:E40E4"]},{"type":"debiancve","idList":["DEBIANCVE:CVE-2017-6301"]},{"type":"nessus","idList":["DEBIAN_DLA-878.NASL"]},{"type":"openvas","idList":["OPENVAS:1361412562310843163","OPENVAS:703846"]},{"type":"ubuntu","idList":["USN-3288-1"]},{"type":"ubuntucve","idList":["UB:CVE-2017-6301"]}]},"exploitation":null,"short_description":" Issue in ytnef before 1.9.1 related to \"4 of 9. Out of Bounds Reads.","tags":["cve-2017-6301","ytnef","patch","out of bounds reads","nvd"],"vulnersScore":7.3},"aiDescription":"CVE-2017-6301 affects ytnef (libytnef) up to 1.9.0; the issue is an out-of-bounds read in the TNEF parsing path described as part of the patch set (4 of 9). Multiple sources (MGASA-2017-0174, USN-4615-1, OSV entries) describe this family of vulnerabilities as heap-related with potential crashes/DoS when processing malicious winmail.dat files. Ubuntu and Mageia advisories indicate a fixed release and advise upgrading to a version containing the libytnef security fixes (e.g., ytnef 1.9.1 or later). The OpenVAS/NAVSL entries corroborate CVEs 2017-6298 through 6306 and related issues; exploitation status is not shown in the provided documents. Remediation: update to patched libytnef/ytnef; no additional mitigation details are provided in the supplied materials.","cpe":["cpe:/a:ytnef_project:ytnef::::"],"cpe23":["cpe:2.3:a:ytnef_project:ytnef:*:*:*:*:*:*:*:*"],"cwe":["CWE-125"],"vulnStatus":"Modified","affectedSoftware":[{"cpeName":"ytnef_project:ytnef","version":"1.9","operator":"le","name":"ytnef_project ytnef"}],"affectedConfiguration":[],"cpeConfiguration":{},"cpeConfigurations":{"nvdCpeConfiguration":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"versionEndIncluding":"1.9","criteria":"cpe:2.3:a:ytnef_project:ytnef:*:*:*:*:*:*:*:*"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"}]}]}],"_index":true},"extraReferences":[{"url":"http://www.debian.org/security/2017/dsa-3846"},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2017-002-ytnef/"},{"url":"http://www.openwall.com/lists/oss-security/2017/02/15/4"},{"url":"https://github.com/Yeraze/ytnef/pull/27"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ/"},{"url":"http://www.securityfocus.com/bid/96423"}],"cnaAffected":[],"cnaCpeApplicability":[],"solutions":[],"workarounds":[],"impacts":[],"exploits":[],"problemTypes":[],"assigned":"2017-02-23T00:00:00","origin":"composite","threatData":{},"webApplicability":{"applicable":null,"vulnerabilities":[]}}}}}