High
Security advisory
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-6308
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:24 UTC · Revision 1
Source evidence
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.
osv:CVE-2017-6308
Complete source record
{
"id": "1f2306b3d498928a4d88de04bff1c4c7078074ed3f6022026e83d1ea3d49d28b",
"url": "https://osv.dev/vulnerability/CVE-2017-6308",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-6308",
"summary": "An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.",
"evidence": "osv:CVE-2017-6308",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-6308",
"aliases": [
"CVE-2017-6308"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/verdammelt/tnef",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "99c70157998ff5f3c3e0fd1669c7cffdaaa32048"
},
{
"fixed": "c5044689e50039635e7700fe2472fd632ac77176"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.4.12"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "c5044689e50039635e7700fe2472fd632ac77176"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.4.12",
"TNEF-1.4.11",
"1.4.11",
"TNEF-1.4.10",
"1.4.10"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6308.json",
"vanir_signatures": [
{
"id": "CVE-2017-6308-1fff0ee7",
"digest": {
"length": 186,
"function_hash": "80647781257308677194827960595707241758"
},
"source": "https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176",
"target": {
"file": "src/alloc.c",
"function": "xmalloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6308-290d50bb",
"digest": {
"length": 105,
"function_hash": "15783034786864080875998758959590555462"
},
"source": "https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176",
"target": {
"file": "src/alloc.c",
"function": "checked_xmalloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6308-3240275e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74577793251357847951624012834623964796",
"259120006362788898557182968957901382749",
"317070988496673012423271087459144346727",
"340003733135942291058728836243182118711",
"283263435890988534721651437552159911026",
"148412461001017286518232540592127839838",
"84359124317468807169832239954705471085",
"24071807926824837838195659260730455448",
"13051942348720689694512385239541424909",
"223943871900041502463050589332055862139",
"12397076515527315894056347930382561746",
"60488618786239953357603483916665940263",
"104482875846109879957863968540076120196",
"87203807592121774978594943157398192512",
"245667685669930674280224660251811031842",
"66520851616452270523773474690296645926",
"289452570597396420023335271120362671879",
"221316349256514322157399797202874492245",
"248376248363180207165795018382301935421",
"326479304575496046329346530080473873827",
"147404952834887334425368163582429953071",
"212121869205416016212422569982659294284",
"147265908407649884497817004294199411165",
"67042311451755526750742529003178827899",
"192757025590116312852855986609378380415",
"32557233928427254309222658051834074695",
"81021220967241253566928732391747722941",
"3756671556585328775992682930143694069",
"27471218305565935940059512140591345026",
"166002946199526813694456530195961979320",
"138137239272367138212280141514087855849",
"51955851802909229003963951751894151703",
"319077333378547946215801557925080714142",
"291748529743512344086676569851897529071",
"199804614681014939756579503354116145175",
"234493078577190041803095131225480610467",
"83868460254598889211169859545503625753",
"238833775603457862769285407875718724835",
"145432519966601555334936527853284898860",
"277217241578896900931443731825823034371",
"159734786079734328005266570997115980067"
]
},
"source": "https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176",
"target": {
"file": "src/alloc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6308-8605cc83",
"digest": {
"length": 167,
"function_hash": "19178948986734914441039532671796522971"
},
"source": "https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176",
"target": {
"file": "src/alloc.c",
"function": "xcalloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6308-bf2571d8",
"digest": {
"length": 139,
"function_hash": "174993485115829299738227768633706098438"
},
"source": "https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176",
"target": {
"file": "src/alloc.c",
"function": "checked_xcalloc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6308-d0e7d33d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244622816174095439308529034456048912615",
"74185541062882661439639506366234940940",
"174781808204308383683905081764386418714",
"243874785623914192116501608322138046359",
"185188867826587436615390029024330879741",
"8818342805407866744885455388093838918",
"22222180561445748243407109619268237743",
"37748432485487720316492973097047514689",
"148567876325088602522738595995016931796",
"40797451203388452006725910471006851070"
]
},
"source": "https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176",
"target": {
"file": "src/alloc.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:27:46Z"
}
}
],
"modified": "2026-10-20T13:27:46.994900039Z",
"provider": "osv",
"references": [
"https://security.gentoo.org/glsa/201708-02",
"https://github.com/verdammelt/tnef/blob/master/ChangeLog",
"https://github.com/verdammelt/tnef/commit/c5044689e50039635e7700fe2472fd632ac77176",
"https://www.x41-dsec.de/lab/advisories/x41-2017-004-tnef/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-6308",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387709,
"published_at": "2017-02-24T04:59:00.607+00:00"
}