Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2019-18849 →

DEBIAN-CVE-2019-18849

In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat app...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 tnef

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1"}]}]

Debian:13 tnef

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1"}]}]

Debian:14 tnef

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1"}]}]

Références

advisory security-tracker.debian.org