Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia: 2019-0367 Moderate: tnef Buffer Over-Read Threat

mageia
Calendar Grey December 6, 2019
Dist Mageia Esm H88
The revised tnef software addresses a vulnerability that permitted unauthorized entry through specially designed email files.
Updated tnef package fixes security vulnerability: In tnef, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmai...

Summary

Updated tnef package fixes security vulnerability:
In tnef, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup (CVE-2019-18849).

References

- https://bugs.mageia.org/show_bug.cgi?id=25785

- https://lists.debian.org/debian-lts-announce/2019/11/msg00035.html

- https://www.cve.org/CVERecord?id=CVE-2019-18849

Topics%20covered

Topics Covered

security advisory email attack buffer over-read Mageia tnef heap-based exploit

Resolution

SRPMS

- 7/core/tnef-1.4.18-1.mga7

Publication date: 06 Dec 2019
URL: https://advisories.mageia.org/MGASA-2019-0367.html
Type: security
CVE: CVE-2019-18849

Topics%20covered

Topics Covered

security advisory email attack buffer over-read Mageia tnef heap-based exploit

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here