CVE-2009-3721 - evolution: TNEF attachment decoder input sanitization errors (oCERT-2009-013)

Back Back to CVE browser

HIGH

evolution: TNEF attachment decoder input sanitization errors (oCERT-2009-013)

Published May 26, 2021

7.8

HIGH

CVSS 3.1

EPSS 1.61%

Description

Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted email could cause these applications to write data in arbitrary locations on the filesystem, crash, or potentially execute arbitrary code when decoding attachments.

Affected products

Vendor n/a Product Ytnef Default
n/a
- Version
  ytnef 2.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Ytnef

n/a

Version	Status	Constraints
ytnef 2.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

http://www.ocert.org/advisories/ocert-2009-013.html
x_refsource_MISCThird Party Advisory
https://access.redhat.com/security/cve/CVE-2009-3721
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=521662
x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3694
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2009-3721
https://www.cve.org/CVERecord?id=CVE-2009-3721

Link	Providers	Tags
http://www.ocert.org/advisories/ocert-2009-013.html		x_refsource_MISCThird Party Advisory
https://access.redhat.com/security/cve/CVE-2009-3721		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=521662		x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3694		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2009-3721
https://www.cve.org/CVERecord?id=CVE-2009-3721