Description
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Yeraze ytnef
Default version status: unaffected
0 to ≤ 2.1.2affected
pkg:github/Yeraze/ytnefReferences
- https://hackmd.io/@haind-pwn/ytnef-decompressrtf-oob-read ↗
- https://github.com/Yeraze/ytnef/issues/112 ↗
- https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1554-L1563 ↗
- https://github.com/Yeraze/ytnef ↗
- https://www.vulncheck.com/advisories/ytnef-through-2.1.2-heap-out-of-bounds-read-via-decompressrtf ↗