CVE-2009-3887 - evolution: TNEF attachment decoder input sanitization errors (oCERT-2009-013)

CRITICAL

evolution: TNEF attachment decoder input sanitization errors (oCERT-2009-013)

Published Oct 29, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 2.53%

ytnef has directory traversal

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
through 2009-09-07 (Fixed In Version: 2.8)	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
http://ocert.org/advisories/ocert-2009-013.html		x_refsource_MISCThird Party Advisory
https://access.redhat.com/security/cve/CVE-2009-3887		Vendor Advisory
https://access.redhat.com/security/cve/cve-2009-3887		x_refsource_MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=521662		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3887		x_refsource_MISCIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2009-3887
https://security-tracker.debian.org/tracker/CVE-2009-3887		x_refsource_MISCThird Party Advisory
https://www.akitasecurity.nl/advisory.php?id=AK20090601		x_refsource_MISCExploitThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2009-3887