PT-2021-8310 · Ytnef+1 · Ytnef+1

Yorick Koster · Published 2021-05-26 · Updated 2021-06-04 · CVE-2009-3721

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions yTNEF (affected versions not specified) Evolution (affected versions not specified)

Description Multiple directory traversal and buffer overflow issues were found in yTNEF and Evolution's TNEF parser, which is derived from yTNEF. A specially crafted email could cause these applications to write data in arbitrary locations on the filesystem, crash, or potentially execute arbitrary code when decoding attachments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-3721

Affected Products

Evolution

Ytnef

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=521662 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-3721 · Security Note
• https://t.me/cvenotify/15579 · Telegram Post
• http://ocert.org/advisories/ocert-2009-013.html · Note