ytnef vulnerabilities

An issue was discovered in ytnef before 1.9.2 related to a potential heap-based buffer over-read on incoming Compressed RTF Streams, concerning the DecompressRTF() function in libytnef.

An issue was discovered in ytnef before version 1.9.2, which may lead to out-of-bounds access due to fields of Size 0 in TNEFParse() in libytnef.

An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.

An issue was discovered in ytnef before version 1.9.1 related to directory traversal using the filename, associated with the SanitizeFilename function in settings.c.

An issue was discovered in ytnef before version 1.9.1 related to a patch described as '8 of 9. Out of Bounds read and write.'

An issue was discovered in ytnef before version 1.9.1 related to a patch described as '7 of 9. Out of Bounds read.'

An issue was discovered in ytnef before version 1.9.1 related to invalid write and integer overflow, which may lead to unauthorized access or data corruption.

An issue was discovered in ytnef before version 1.9.1 related to an integer overflow, described as '5 of 9'.

An issue was discovered in ytnef before version 1.9.1 related to out of bounds reads.

An issue was discovered in ytnef before 1.9.1 related to a buffer overflow in the version field in lib/tnef-types.h.

An issue was discovered in ytnef before version 1.9.1 related to null pointer dereference and unchecked return value from calloc.

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator.

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property.