335 matches found
USN-4524-1: TNEF vulnerabilities
Paul Dreik discovered that TNEF incorrectly handled filenames. If a user were tricked into opening a specially crafted email attachment, an attacker could possibly use this issue to write arbitrary files to the filesystem or cause TNEF crash, resulting in a denial of service. CVE-2019-18849...
Denial Of Service (DoS)
tnef is vulnerable to denial of service DoS. The vulnerability exists through a heap-based buffer over-read in strdup, allowing an attacker may be able to write to the victim's .ssh/authorizedkeys file through an e-mail message with a crafted winmail.dat application/ms-tnef attachment...
Ubuntu 16.04 LTS : TNEF vulnerabilities (USN-4524-1)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4524-1 advisory. Paul Dreik discovered that TNEF incorrectly handled filenames. If a user were tricked into opening a specially crafted email attachment, an attacker could possibl...
Fedora Update for tnef FEDORA-2019-815807c020
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora Update for tnef FEDORA-2019-5f14b810f8
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
MGASA-2019-0367 Updated tnef packages fix security vulnerability
Updated tnef package fixes security vulnerability: In tnef, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup CVE-2019-18849...
Updated tnef packages fix security vulnerability
Updated tnef package fixes security vulnerability: In tnef, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup CVE-2019-18849...
[SECURITY] Fedora 31 Update: tnef-1.4.18-1.fc31
This application provides a way to unpack Microsoft MS-TNEF MIME attachment s. It operates like tar in order to unpack files of type "application/ms-tnef", which may have been placed into the MS-TNEF attachment instead of being attached separately. Such files may have attachment names similar to...
[SECURITY] Fedora 30 Update: tnef-1.4.18-1.fc30
This application provides a way to unpack Microsoft MS-TNEF MIME attachment s. It operates like tar in order to unpack files of type "application/ms-tnef", which may have been placed into the MS-TNEF attachment instead of being attached separately. Such files may have attachment names similar to...
Fedora 30 : tnef (2019-5f14b810f8)
tnef release 1.4.18. ==================== Security release to resolve CVE-2019-18849 in which it may be possible to attack via a crafted email message extracted via tnef. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system websit...
Fedora 31 : tnef (2019-815807c020)
tnef release 1.4.18. ==================== Security release to resolve CVE-2019-18849 in which it may be possible to attack via a crafted email message extracted via tnef. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system websit...
Debian DLA-2005-1 : tnef security update
In tnef, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup. For Debian 8 'Jessie', this problem has been fixed in version...
Debian: Security Advisory (DLA-2005-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 2005-1] tnef security update
Package : tnef Version : 1.4.9-1+deb8u4 CVE ID : CVE-2019-18849 Debian Bug : 944851 In tnef, an attacker may be able to write to the victims .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving...
DLA-2005-1 tnef - security update
Bulletin has no description...
Vulnerability fixed in TNEF
A new patch of TNEF has been released, in which a vulnerability has been fixed. The vulnerability allows a malicious person able to execute arbitrary code under the privileges of the user. TNEF has made available a patch that fixes the vulnerability. fix. More information can be found on the...
DEBIAN-CVE-2019-18849
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup...
CVE-2019-18849
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup...
CVE-2019-18849
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup...
CVE-2019-18849
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup...