Description
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Yeraze ytnef
Default version status: unaffected
0 to ≤ 2.1.2affected
pkg:github/Yeraze/ytnefReferences
- https://hackmd.io/@haind-pwn/ytnef-decompressrtf-oob-read ↗
- https://github.com/Yeraze/ytnef/issues/112 ↗
- https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1449-L1458 ↗
- https://github.com/Yeraze/ytnef/blob/d9f089144414d3b0912c29ab96f8f1c591d00319/lib/ytnef.c#L1605-L1614 ↗
- https://github.com/Yeraze/ytnef ↗
- https://www.vulncheck.com/advisories/ytnef-through-2.1.2-heap-out-of-bounds-read-via-mapiprint-in-lib-ytnef-c ↗